A flaw has been found in Edimax BR-6208AC 1.32

The Edimax BR-6208AC device running version 1.32 contains a flaw in one of its web-accessible functions, the /goform/mp path. Because of how this function handles input, an attacker can slip operating system commands into a request and the device will run them. This is called command injection: the device mistakes attacker-supplied data for instructions.

According to the official description, the attack can be launched over the network, an exploit has already been published, and the vendor did not respond when contacted. Anyone operating this device, whether in a home, small office or branch location, should treat it as at risk until it is isolated or replaced.