Vulnerability · Published Jan 9, 2026 · Assigned by mitre
CVE-2025-70161
Critical 9.8
In plain English
A critical-severity command injection in the affected software. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 27.1% (higher than 98% of all known vulnerabilities).
Severity (CVSS 3.1)9.8Critical
Exploit odds (30 days)27.1%top 1.9% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
EDIMAX BR-6208AC V2_1.02 is vulnerable to Command Injection. This arises because the pppUserName field is directly passed to a shell command via the system() function without proper sanitization. An attacker can exploit this by injecting malicious commands into the pppUserName field, allowing arbitrary code execution.
Affected products (as reported)
Weakness: CWE-77 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H