CVE-2025-14910
📋 TL;DR
This CVE describes a path traversal vulnerability in the FTP daemon service of Edimax BR-6208AC routers. Attackers can exploit this remotely to access files outside the intended directory. Only users of this discontinued router model are affected.
💻 Affected Systems
- Edimax BR-6208AC
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Unauthorized access to sensitive system files, configuration data, or credentials stored on the router.
Likely Case
Information disclosure of router configuration files or limited file system access.
If Mitigated
No impact if FTP service is disabled or device is not internet-facing.
🎯 Exploit Status
Public exploit details available; path traversal vulnerabilities typically have straightforward exploitation.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: None
Vendor Advisory: Not provided in CVE details
Restart Required: No
Instructions:
No official patch available. Vendor recommends disabling FTP service or replacing hardware.
🔧 Temporary Workarounds
Disable FTP Service
allTurn off the FTP daemon to eliminate the attack vector while maintaining other router functions.
Access router admin interface > Services > FTP > Disable
🧯 If You Can't Patch
- Disable FTP service immediately via router administration interface
- Replace router with supported model as recommended by vendor
🔍 How to Verify
Check if Vulnerable:
Check router model (BR-6208AC) and firmware version (1.02) in admin interface. Verify if FTP service is enabled.Check Version:
Check via router web interface at 192.168.2.1 or similar default gatewayVerify Fix Applied:
Confirm FTP service shows as disabled in router administration interface.📡 Detection & Monitoring
Log Indicators:
- Unusual FTP connection attempts
- FTP commands with '../' patterns
- Access to non-standard file paths
Network Indicators:
- Port 21 traffic to router from unexpected sources
- FTP protocol anomalies
SIEM Query:
source_port:21 AND (uri_contains:"../" OR uri_contains:"..\")