CRITICALVulnerability
Verified
Global

NVD CRITICAL: CVE-2026-108918 — A vulnerability was identified in Edimax BR-6208AC 1.32. Impacted is an unknown ...

·Source: NIST NVD

Updated:

Executive Summary

A vulnerability was identified in Edimax BR-6208AC 1.32. Impacted is an unknown function of the file /goform/formWlanMP. The manipulation of the argument readE2P leads to command injection. It is possible to initiate the attack remotely. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way. This vulnerability only

Analysis

A vulnerability was identified in Edimax BR-6208AC 1.32. Impacted is an unknown function of the file /goform/formWlanMP. The manipulation of the argument readE2P leads to command injection. It is possible to initiate the attack remotely. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way. This vulnerability only affects products that are no longer supported by the maintainer. CVSS Score: 10. Published: 2026-10-12T18:17:22.353.

Indicators of Compromise (1)

CVE (1)
CVE-2026-108918
NVDMITRE CVE
Source Attribution

Originally published by NIST NVD on Oct 12, 2026. Verified by: NIST.

Related Threats

CRITICALVulnerability

PHP2Shell: Two Unpatched Critical PHP RCE Flaws (CVSS 9.2) Trigger Emergency Security Alert

PHP will ship an out-of-cycle security release at 14:00 UTC today, October 21, for two critical vulnerabilities that its security team has rated 9.2 on the CVSS v4.0 scale but has not described. Security researchers at watchTowr say the two flaws allow remote code execution. Only the four supported PHP branches, 8.2 through 8.5, can receive the fix, and no exploitation has been reported so far.

The Hacker News
MEDIUMVulnerability

Accenture, Dragos, SANS Launch $10M Initiative to Defend Small US Utilities

The first phase will cover up to 500 utilities, which will get free security tools, equipment, deployment help and training. The post Accenture, Dragos, SANS Launch $10M Initiative to Defend Small US Utilities appeared first on SecurityWeek .

SecurityWeek
CRITICALVulnerability

PHP Announces Critical Security Release for Two Vulnerabilities

On October 20, 2026, the PHP security team announced an upcoming security release addressing two critical vulnerabilities, each rated CVSS v4.0 9.2. The release is scheduled for October 21, 2026, at 14:00 UTC. PHP has indicated that the updates may be released earlier if vulnerability details become public or evidence of active exploitation emerges. Public […]

Qualys Blog