CVE-2026-1972 in BR-6208AC
Summary
by MITRE • 02/06/2026
A vulnerability was found in Edimax BR-6208AC 2_1.02. The affected element is the function auth_check_userpass2. Performing a manipulation of the argument Username/Password results in use of default credentials. The attack may be initiated remotely. The exploit has been made public and could be used. The vendor confirms that the affected product is end-of-life. They confirm that they "will issue a consolidated Security Advisory on our official support website." This vulnerability only affects products that are no longer supported by the maintainer.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 02/20/2026
The vulnerability identified as CVE-2026-1972 resides within the Edimax BR-6208AC 2_1.02 router firmware, specifically within the auth_check_userpass2 function that handles user authentication processes. This authentication mechanism represents a critical security flaw that allows attackers to bypass normal login procedures by manipulating the Username and Password parameters during the authentication flow. The vulnerability stems from improper input validation and handling within the authentication subsystem, creating a path for unauthorized access through default credential exploitation. According to industry standards such as CWE-287, this vulnerability aligns with improper authentication weaknesses that enable attackers to gain unauthorized access to systems through flawed authentication mechanisms. The flaw manifests when the system fails to properly validate user credentials, instead falling back to default credential usage when manipulated inputs are detected.
The technical exploitation of this vulnerability occurs through remote manipulation of the authentication parameters, allowing attackers to leverage default credentials without proper authorization. This remote attack vector eliminates the need for physical access to the device and can be executed from any network location capable of reaching the router's administrative interface. The authentication bypass mechanism operates by manipulating the Username/Password arguments in a way that triggers the system to accept default credentials rather than processing the provided authentication information. This vulnerability demonstrates a classic case of insecure authentication handling where the system does not adequately sanitize or validate user inputs before processing authentication requests. The attack surface is particularly concerning as it affects network infrastructure devices that often serve as entry points for broader network compromises, aligning with ATT&CK technique T1078 for valid accounts and T1046 for network service scanning.
The operational impact of this vulnerability extends beyond simple unauthorized access, as it creates a persistent security risk for networks utilizing the affected Edimax BR-6208AC devices. Once exploited, attackers can gain administrative control over the router, potentially enabling them to modify network configurations, redirect traffic, implement man-in-the-middle attacks, or establish persistent backdoors within the network infrastructure. The end-of-life status of the affected product compounds the risk significantly, as the vendor has ceased providing security updates or patches for this device. This leaves affected organizations with no official remediation path, forcing them to either replace the hardware or accept the security risk. The public availability of exploitation methods further amplifies the threat landscape, as malicious actors can readily implement these techniques without requiring specialized knowledge or tools. Network security professionals should consider this vulnerability as a high-priority threat due to its remote exploitability and the lack of vendor support for remediation.
Organizations affected by this vulnerability should immediately implement network segmentation strategies to isolate potentially compromised devices and monitor network traffic for suspicious activity. The recommended mitigation approach includes replacing the affected hardware with supported models that receive regular security updates and firmware patches. Network administrators should also consider implementing additional security controls such as network access control lists, intrusion detection systems, and monitoring for unusual authentication patterns. The vulnerability's classification under CWE-287 highlights the importance of implementing robust authentication mechanisms that properly validate user inputs and prevent fallback to default credentials. Given the end-of-life status of the affected product, organizations must prioritize hardware replacement as the most effective long-term solution. Security teams should also document this vulnerability in their risk assessment frameworks and consider it as part of their overall network infrastructure security posture, particularly when evaluating legacy device support and retirement planning. The public exploit availability makes this vulnerability particularly dangerous as it can be immediately leveraged by threat actors without requiring advanced technical skills or specialized knowledge of the specific device's internal workings.