CVE-2025-14910 in BR-6208AC
Summary
by MITRE • 12/19/2025
A vulnerability was detected in Edimax BR-6208AC 1.02. This impacts the function handle_retr of the component FTP Daemon Service. The manipulation results in path traversal. The attack may be launched remotely. The exploit is now public and may be used. Edimax confirms this issue: "This product is no longer available in the market and has been discontinued for five years. Consequently, Edimax no longer provides technical support, firmware updates, or security patches for this specific model. However, to ensure the safety of our remaining active users, we acknowledge this report and will take the following mitigation actions: (A) We will issue an official security advisory on our support website. (B) We will strongly advise users to disable the FTP service on this device to mitigate the reported risk, by which the product will still work for common use. (C) We will recommend users upgrade to newer, supported models." This vulnerability only affects products that are no longer supported by the maintainer.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 01/12/2026
The vulnerability identified as CVE-2025-14910 represents a critical path traversal flaw within the FTP Daemon Service of Edimax BR-6208AC version 1.02 devices. This issue manifests in the handle_retr function, which processes file retrieval operations within the FTP protocol implementation. The flaw allows attackers to manipulate file path parameters and traverse directories beyond the intended scope, potentially accessing sensitive system files, configuration data, or other restricted resources. The vulnerability's remote exploitability means that attackers can leverage this weakness without requiring physical access to the device, making it particularly dangerous in networked environments where such legacy equipment may still be operational.
This vulnerability directly maps to CWE-22 Path Traversal and aligns with ATT&CK technique T1213.002 Access to Cloud Storage, as it enables unauthorized file system access through network-based exploitation. The attack vector is particularly concerning because it targets a core network service functionality that many organizations may not realize is still active on legacy devices. The public availability of exploit code significantly increases the risk surface, as malicious actors can readily implement this attack without specialized knowledge. The fact that this vulnerability affects a discontinued product model compounds the security risk, as users have no official support channels to obtain patches or updates.
The operational impact of this vulnerability extends beyond simple unauthorized data access. Attackers could potentially extract sensitive configuration files, access system logs, or even gain insights into network topology and device management interfaces. The path traversal capability may enable further exploitation attempts, including privilege escalation or information disclosure that could compromise broader network security. Organizations that continue to operate this discontinued model face significant exposure, particularly in environments where legacy equipment remains connected to production networks. The vulnerability's presence in a device that has been discontinued for five years creates a particularly challenging security scenario, as there are no official remediation paths available through standard support channels.
The mitigation strategy recommended by Edimax includes disabling the FTP service entirely, which represents a prudent defensive measure for users who cannot immediately replace the device. This approach aligns with the principle of least privilege and reduces the attack surface by eliminating an unnecessary network service. The company's decision to issue an official security advisory demonstrates responsible disclosure practices, though the lack of firmware updates for the discontinued model leaves users with limited options. The recommendation to upgrade to newer models addresses the root cause while acknowledging that many users may be constrained by budget, compatibility, or operational requirements. Organizations should implement network segmentation to isolate devices running this legacy firmware, deploy intrusion detection systems to monitor for exploitation attempts, and consider implementing network access controls that prevent unauthorized FTP service access. The vulnerability serves as a stark reminder of the persistent security risks associated with legacy equipment in operational environments.