CVE-2026-1972
Published: 06 February 2026
Summary
CVE-2026-1972 is a medium-severity Use of Default Credentials (CWE-1392) vulnerability in Edimax Br-6208Ac Firmware. Its CVSS base score is 5.3 (Medium).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 5.1th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
Threat & Defense at a Glance
Threat & Defense Details
Likely Mitigating ControlsAI
Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.
Mandates replacement of default credentials during secure configuration and provisioning procedures.
Policy requires changing or avoiding default credentials during system setup and operation.
Unique identification requirement prevents use of default or shared credentials by organizational users.
Changing default authenticators prior to first use prevents use of default credentials.
Standards-compliant authentication mechanisms typically prohibit default credentials for cryptographic modules.
Consistent implementation of the strategy drives removal or mitigation of default credentials in procured systems and services.
Security functional requirements and acceptance criteria can stipulate that acquired systems must not use default credentials.
Documentation of known configuration vulnerabilities and secure setup practices reduces reliance on default credentials.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Vulnerability in public-facing router auth function directly enables remote unauthenticated exploitation via default credentials.
NVD Description
A vulnerability was found in Edimax BR-6208AC 2_1.02. The affected element is the function auth_check_userpass2. Performing a manipulation of the argument Username/Password results in use of default credentials. The attack may be initiated remotely. The exploit has been made public…
more
and could be used. The vendor confirms that the affected product is end-of-life. They confirm that they "will issue a consolidated Security Advisory on our official support website." This vulnerability only affects products that are no longer supported by the maintainer.
Deeper analysisAI
CVE-2026-1972 is a vulnerability in the Edimax BR-6208AC router firmware version 2_1.02, specifically affecting the auth_check_userpass2 function. It enables attackers to manipulate the Username/Password argument, resulting in the use of default credentials. This issue, classified under CWE-1392, carries a CVSS v3.1 base score of 5.3 (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N), indicating medium severity with low confidentiality impact.
The vulnerability can be exploited remotely by unauthenticated attackers over the network with low complexity and no user interaction required. Successful exploitation allows limited access to confidential information via the default credentials, as the attack vector is network-accessible and requires no privileges.
Advisories note that the affected product is end-of-life and no longer supported by the vendor, who confirms it impacts only unsupported devices. Edimax states they will issue a consolidated Security Advisory on their official support website, but no patches are available due to the product's discontinued status.
The exploit has been made publicly available, increasing the risk for deployed devices. References include detailed analyses on VulDB and a Notion page documenting the weak password authentication issue.
Details
- CWE(s)