How severe is CVE-2025-14910?

CVE-2025-14910 has a CVSS 3.x base score of 4.3, rated medium severity. It is exploitable over network with low attack complexity, requires low privileges and no user interaction. Impact on confidentiality is low, integrity none, and availability none.

Is CVE-2025-14910 being actively exploited?

It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 0% (36th percentile), an estimate of the probability of exploitation in the next 30 days.

What products are affected by CVE-2025-14910?

CVE-2025-14910 affects Edimax Br-6208ac Firmware. See the affected-products list for the exact vulnerable versions.

How do I fix CVE-2025-14910?

Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.

Does CVE-2025-14910 have an EU (EUVD) identifier?

Yes. CVE-2025-14910 is tracked in the ENISA EU Vulnerability Database (EUVD) as EUVD-2025-204431.

When was CVE-2025-14910 published?

CVE-2025-14910 was published on 2025-12-19 and last updated on 2026-06-17.

CVE-2025-14910

CVE-2025-14910 is a medium-severity vulnerability in Edimax Br-6208ac Firmware with a CVSS 3.x base score of 4.3. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low. The underlying weakness is classified as CWE-22.

Key facts

Severity: Medium (CVSS 3.x base score 4.3)
CVSS v2: 4.0
CVSS v4: 2.1
EPSS exploit prediction: 0% (36th percentile)
Actively exploited: Not listed in CISA KEV
EU (EUVD) id: EUVD-2025-204431
Weakness: CWE-22
Affected product: Edimax Br-6208ac Firmware
Published: 2025-12-19
Last modified: 2026-06-17

Description

A vulnerability was detected in Edimax BR-6208AC 1.02. This impacts the function handle_retr of the component FTP Daemon Service. The manipulation results in path traversal. The attack may be launched remotely. The exploit is now public and may be used. Edimax confirms this issue: "This product is no longer available in the market and has been discontinued for five years. Consequently, Edimax no longer provides technical support, firmware updates, or security patches for this specific model. However, to ensure the safety of our remaining active users, we acknowledge this report and will take the following mitigation actions: (A) We will issue an official security advisory on our support website. (B) We will strongly advise users to disable the FTP service on this device to mitigate the reported risk, by which the product will still work for common use. (C) We will recommend users upgrade to newer, supported models." This vulnerability only affects products that are no longer supported by the maintainer.

Frequently asked questions

What is CVE-2025-14910?: A vulnerability was detected in Edimax BR-6208AC 1.02. This impacts the function handle_retr of the component FTP Daemon Service. The manipulation results in path traversal. The attack may be launched remotely. The exploit is now public and may be used. Edimax confirms this issue: "This product is no longer available in the market and has been discontinued for five years. Consequently, Edimax no longer provides technical support, firmware updates, or security patches for this specific model. However, to ensure the safety of our remaining active users, we acknowledge this report and will take the following mitigation actions: (A) We will issue an official security advisory on our support website. (B) We will strongly advise users to disable the FTP service on this device to mitigate the reported risk, by which the product will still work for common use. (C) We will recommend users upgrade to newer, supported models." This vulnerability only affects products that are no longer supported by the maintainer.
How severe is CVE-2025-14910?: CVE-2025-14910 has a CVSS 3.x base score of 4.3, rated medium severity. It is exploitable over network with low attack complexity, requires low privileges and no user interaction. Impact on confidentiality is low, integrity none, and availability none.
Is CVE-2025-14910 being actively exploited?: It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 0% (36th percentile), an estimate of the probability of exploitation in the next 30 days.
What products are affected by CVE-2025-14910?: CVE-2025-14910 affects Edimax Br-6208ac Firmware. See the affected-products list for the exact vulnerable versions.
How do I fix CVE-2025-14910?: Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.
Does CVE-2025-14910 have an EU (EUVD) identifier?: Yes. CVE-2025-14910 is tracked in the ENISA EU Vulnerability Database (EUVD) as EUVD-2025-204431.
When was CVE-2025-14910 published?: CVE-2025-14910 was published on 2025-12-19 and last updated on 2026-06-17.

References

Affected products (1)

cpe:2.3:o:edimax:br-6208ac_firmware:1.02:*:*:*:*:*:*:*

More vulnerabilities in Edimax Br-6208ac Firmware

CVE-2025-70161 — Critical (CVSS 9.8): EDIMAX BR-6208AC V2_1.02 is vulnerable to Command Injection. This arises because the pppUserName field is directly…
CVE-2025-15257 — High (CVSS 7.3): A security flaw has been discovered in Edimax BR-6208AC 1.02/1.03. Affected by this vulnerability is the function…
CVE-2025-15256 — High (CVSS 7.3): A vulnerability was identified in Edimax BR-6208AC 1.02/1.03. Affected is the function formStaDrvSetup of the file…
CVE-2026-1972 — Medium (CVSS 5.3): A vulnerability was found in Edimax BR-6208AC 2_1.02. The affected element is the function auth_check_userpass2.…
CVE-2025-15258 — Low (CVSS 3.5): A weakness has been identified in Edimax BR-6208AC 1.02/1.03. Affected by this issue is the function formALGSetup of…

All CVEs affecting Edimax Br-6208ac Firmware →

Other CWE-22 (Path Traversal) vulnerabilities

CVE-2026-48282 — Critical (CVSS 10.0): ColdFusion versions 2025.9, 2023.20 and earlier are affected by an Improper Limitation of a Pathname to a Restricted…
CVE-2026-54917 — Critical (CVSS 10.0): SeaweedFS is a distributed storage system for object storage (S3), file systems, and Iceberg tables. Prior to 4.30, the…
CVE-2026-11429 — Critical (CVSS 10.0): Two endpoints in the Vault Service ScriptsController, shared by Altium Enterprise Server and Altium 365, accept file…
CVE-2026-34909 — Critical (CVSS 10.0): A malicious actor with access to the network could exploit a Path Traversal vulnerability found in UniFi OS devices to…
CVE-2026-7411 — Critical (CVSS 10.0): In Eclipse BaSyx Java Server SDK versions prior to 2.0.0-milestone-10, inadequate path normalization in the Submodel…
CVE-2026-36767 — Critical (CVSS 10.0): A path traversal vulnerability in the /content/images/add endpoint of shopizer v3.2.5 allows attackers write arbitrary…

Browse all CWE-22 (Path Traversal) vulnerabilities →