CVE-2025-70161

Edimax BR-6208AC V2 routers running firmware 1.02 (V2_1.02) are vulnerable to OS command injection (CWE-77): the web interface's setWAN handler passes the PPPoE pppUserName field directly to the system() function without sanitization. An attacker who can reach the router's web management interface can submit a crafted PPPoE username containing shell metacharacters, causing arbitrary commands to execute on the device. Successful exploitation yields full router compromise with high impact on confidentiality, integrity, and availability (CVSS 3.1 9.8), and a foothold for further attacks such as traffic interception or pivoting into the LAN. Only Edimax BR-6208AC V2 devices on the affected firmware are implicated, with exposure driven chiefly by whether the management interface is reachable from untrusted networks such as the WAN side. No in-the-wild exploitation is confirmed and the flaw is not in CISA's KEV, but a public proof-of-concept writeup exists and EPSS assigns a 27.1% probability of exploitation within 30 days (98th percentile), making it a near-term risk.

What to do: Inventory Edimax BR-6208AC V2 devices and check the running firmware version; if it is 1.02, apply a vendor firmware update when one becomes available (no fixed version is documented in the current data). Until patched, do not expose the router's web management interface to the WAN or other untrusted networks, disable remote administration, and avoid PPPoE credentials containing shell metacharacters where possible. No exploitation is confirmed in the wild, but given the elevated EPSS score, monitor Edimax advisories and treat WAN-reachable units as priority targets.