Medium severity · published Dec 30, 2025
CVE-2025-15258
Edimax BR-6208AC Web-based Configuration formALGSetup redirect
6.1
CVSS
0.3%
EPSS
No
On KEV
Description
A weakness has been identified in Edimax BR-6208AC 1.02/1.03. Affected by this issue is the function formALGSetup of the file /goform/formALGSetup of the component Web-based Configuration Interface. This manipulation of the argument wlan-url causes open redirect. The attack is possible to be carried out remotely. The exploit has been made available to the public and could be used for attacks. Edimax confirms this issue: "The product mentioned, EDIMAX BR-6208AC V2, has reached its End of Life (EOL) status. It is no longer supported or maintained by Edimax, and it is no longer available for purchase in the market. Consequently, there will be no further firmware updates or patches for this device. We recommend users upgrade to newer models for better security." This vulnerability only affects products that are no longer supported by the maintainer.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
Required
Confidentiality
Low
Integrity
Low
Availability
None
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)0.3% · higher than 18% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
BR
BR-6208AC · Edimax
1.02; 1.03 · source: vendor
BF
Br-6208ac Firmware · Edimax
1.02; 1.03 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2025-15258
CVE.org
https://www.cve.org/CVERecord?id=CVE-2025-15258
Exploit
https://tzh00203.notion.site/EDIMAX-BR-6208AC-V2_1-02-Open-Redirect-Vulnerability-in-Web-formALGSetup-handler-2d3b5c52018a80188e9ae30d3cc8c3d1?source=copy_link
Permissions Required
https://vuldb.com/?ctiid.338648
Third Party Advisory
https://vuldb.com/?id.338648
Third Party Advisory
https://vuldb.com/?submit.722446
More from BR-6208AC
10.0
CVE-2026-108918
Edimax BR-6208AC formWlanMP command injection
10.0
CVE-2026-108917
Edimax BR-6208AC formAutoFWupgrade command injection
9.9
CVE-2026-108915
Edimax BR-6208AC formWlanMP buffer overflow
9.9
CVE-2026-108914
Edimax BR-6208AC formWlSiteSurvey buffer overflow
9.8
CVE-2025-70161
EDIMAX BR-6208AC V2_1.02 is vulnerable to Command Injection
