PT-2026-1955 · Edimax · Edimax Br-6208Ac

Published 2026-01-09 · Updated 2026-01-12 · CVE-2025-70161

Positive Technologies (AI Summary)

CVSS v2.0

10

Critical

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions EDIMAX BR-6208AC version V2 1.02

Description The EDIMAX BR-6208AC version V2 1.02 is susceptible to Command Injection. The issue occurs because the pppUserName field is passed directly to a shell command using the system() function without sufficient input validation. An attacker can exploit this by injecting malicious commands into the pppUserName field, potentially leading to arbitrary code execution.

Recommendations Update to a newer version that contains a fix for this vulnerability.

Exploit

Fix

Command Injection

Weakness Enumeration

CWE-77

Related Identifiers

BDU:2026-05046

CVE-2025-70161

Affected Products

Edimax Br-6208Ac

References · 7

• 🔥 https://tzh00203.notion.site/EDIMAX-BR-6208AC-V2_1-02-Command-Injection-Vulnerability-in-Web-setWAN-handler-2d3b5c52018a80d7ae8dce2bf5e3294c?source=copy_link · Exploit
• https://bdu.fstec.ru/vul/2026-05046 · Security Note
• https://osv.dev/vulnerability/CVE-2025-70161 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-70161 · Security Note
• https://twitter.com/CVEnew/status/2009670034143010963 · Twitter Post
• https://twitter.com/TheHackerWire/status/2010789965102530933 · Twitter Post
• https://t.me/CVEtracker/41864 · Telegram Post