An unauthenticated remote command injection vulnerability exists in the Edimax BR-6208AC router, which is end of life and will not receive security patches.

The vulnerability exists in the formRoute function within the web-based configuration interface. An unauthenticated attacker can supply malicious input to the strIp, strMask, or strGateway parameters to achieve command injection.

This vulnerability carries a CVSS score of 7.3, reflecting its high severity due to the lack of required authentication and the potential for remote code execution. Successful exploitation allows an attacker to gain unauthorized control over the network device, potentially leading to full network compromise, data interception, or the use of the device as a pivot point for further attacks on internal systems.

Immediate Action: Because the device has reached End of Life (EOL) status and no firmware patches will be issued, the only effective remediation is to decommission the affected hardware and replace it with a supported model.

Proactive Monitoring: Monitor network traffic for unusual outbound connections from the router and inspect system logs for anomalous web requests targeting the /gogorm/formRoute endpoint.

Compensating Controls: If the device cannot be immediately removed, isolate it from the public internet using a restrictive firewall policy or a Virtual Private Network (VPN) to prevent remote access to the configuration interface.

Public Exploit Available: Yes, a published proof-of-concept exists as documented in the researcher write-up linked in the vulnerability references.

Given that Edimax has confirmed the product is end of life and will not receive further security updates, the risk of continued use is extreme. Security teams should prioritize the immediate retirement and replacement of these units. If immediate replacement is not feasible, the devices must be removed from any network segment that is exposed to the internet.