CVE-2025-14910 Edimax BR-6208AC FTP Daemon Service handle_retr path traversal
Remote attackers can exploit a path traversal flaw in the FTP daemon to read arbitrary files on discontinued Edimax routers.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2025-14910?
CVE-2025-14910 is a medium-severity path traversal vulnerability in Edimax BR-6208AC, published on 19 Dec 2025. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
A vulnerability was detected in Edimax BR-6208AC 1.02. This impacts the function handle_retr of the component FTP Daemon Service. The manipulation results in path traversal. The attack may be launched remotely. The exploit is now public and may be used. Edimax confirms this issue: "This product is no longer available in the market and has been discontinued for five years. Consequently, Edimax no longer provides technical support, firmware updates, or security patches for this specific model. However, to ensure the safety of our remaining active users, we acknowledge this report and will take the following mitigation actions: (A) We will issue an official security advisory on our support website. (B) We will strongly advise users to disable the FTP service on this device to mitigate the reported risk, by which the product will still work for common use. (C) We will recommend users upgrade to newer, supported models." This vulnerability only affects products that are no longer supported by the maintainer.
Weakness: CWE-22
Which versions are affected by CVE-2025-14910?
It affects 1 product.
Products include Edimax Br-6208ac Firmware.
How do I fix CVE-2025-14910?
No fix has been published for CVE-2025-14910 yet. Limit exposure of the affected software until one is available.
Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.
Is CVE-2025-14910 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2025-14910 exists.
Other vulnerabilities in Edimax BR-6208AC
- CVE-2025-70161 Command injection in n/a
- CVE-2026-1972 Edimax BR-6208AC auth_check_userpass2 default credentials
- CVE-2025-15256 Edimax BR-6208AC Web-based Configuration formStaDrvSetup command injection
- CVE-2025-15257 Edimax BR-6208AC Web-based Configuration formRoute command injection
- CVE-2025-15258 Edimax BR-6208AC Web-based Configuration formALGSetup redirect
Sources
Also known as GHSA-x3hm-53cx-8hp8.