The Edimax BR-6208AC router is vulnerable to unauthenticated remote command injection, posing a severe risk as the device has reached end of life status with no available patches.

The device is susceptible to command injection (CWE-77) within the web-based configuration interface. An unauthenticated remote attacker can trigger this by manipulating the rootAPmac argument within the formStaDrvSetup function.

Successful exploitation allows an attacker to execute arbitrary commands on the affected router, potentially leading to a complete compromise of the device. Given the CVSS score of 7.3, this represents a high-severity risk that could facilitate unauthorized network access, interception of traffic, or the use of the device as a pivot point into the local network. Because the product is end of life, there is no path to remediation, leaving the device permanently exposed to this vulnerability.

Immediate Action: Since the product has reached end of life and no patches are available, the only effective remediation is to retire and replace the affected hardware with a supported device immediately.

Proactive Monitoring: Monitor network traffic for suspicious activity originating from or directed toward the router, specifically looking for unusual HTTP POST requests to the /goform/formStaDrvSetup endpoint.

Compensating Controls: If immediate replacement is not feasible, isolate the device from the public internet using an upstream firewall and disable the web-based management interface if possible to prevent remote access.

Public Exploit Available: Yes — a published proof of concept exists, as documented in the research write up linked in the vulnerability references.

The severity of this vulnerability, combined with the lack of vendor support, necessitates the immediate decommissioning of all Edimax BR-6208AC devices. Organizations should prioritize the replacement of these routers to eliminate the risk of remote command execution, as no firmware updates will be provided to mitigate this flaw.