CVE-2025-14910

A vulnerability was detected in Edimax BR-6208AC 1.02. This impacts the function handle_retr of the component FTP Daemon Service. The manipulation results in path traversal. The attack may be launched remotely. The exploit is now public and may be used. Edimax confirms this issue: "This product is no longer available in the market and has been discontinued for five years. Consequently, Edimax no longer provides technical support, firmware updates, or security patches for this specific model. However, to ensure the safety of our remaining active users, we acknowledge this report and will take the following mitigation actions: (A) We will issue an official security advisory on our support website. (B) We will strongly advise users to disable the FTP service on this device to mitigate the reported risk, by which the product will still work for common use. (C) We will recommend users upgrade to newer, supported models." This vulnerability only affects products that are no longer supported by the maintainer.

• CWE-22

• https://tzh00203.notion.site/EDIMAX-BR-6208AC-V2_1-02-Path-Traversal-Vulnerability-in-FTPd-2c4b5c52018a80fb8812f7d510abf558?source=copy_linkExploit, Third Party Advisory
• https://vuldb.com/?ctiid.337435Permissions Required, VDB Entry
• https://vuldb.com/?id.337435Third Party Advisory, VDB Entry
• https://vuldb.com/?submit.713704Third Party Advisory, VDB Entry

Published

Dec 19, 2025

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2025-14905A flaw was found in the 389-ds-base server. A heap buffer ov…7.2
• CVE-2025-14906The WP Youtube Video Gallery plugin for WordPress is vulnera…4.3
• CVE-2025-14907The Moderate Selected Posts plugin for WordPress is vulnerab…4.3
• CVE-2025-14908A security flaw has been discovered in JeecgBoot up to 3.9.0…8.1
• CVE-2025-14909A weakness has been identified in JeecgBoot up to 3.9.0. The…8.1
• CVE-2025-1491The WP Posts Carousel plugin for WordPress is vulnerable to …6.4
• CVE-2025-14911User-controlled chunkSize metadata from MongoDB lacks approp…7.1
• CVE-2025-14912IBM InfoSphere Information Server 11.7.0.0 through 11.7.1.6 …5.4
• CVE-2025-14913The Frontend Post Submission Manager Lite – Frontend Posting…5.3
• CVE-2025-14914IBM WebSphere Application Server Liberty 17.0.0.3 through 26…7.6
• CVE-2025-14915IBM WebSphere Application Server - Liberty 17.0.0.3 through …7.2
• CVE-2025-14917IBM WebSphere Application Server - Liberty 17.0.0.3 through …9.8