PT-2026-25946 · Edimax · Edimax Gs-5008Pl

Kazuma Matsumoto · Publicado 2026-03-17 · Atualizado 2026-03-18 · CVE-2026-32840

Positive Technologies (AI Summary)

CVSS v2.0

5.5

Média

Vetor base

AV:N/AC:L/Au:S/C:P/I:P/A:N

Name of the Vulnerable Software and Affected Versions Edimax GS-5008PL firmware versions prior to 1.00.54

Description The Edimax GS-5008PL firmware contains a stored cross-site scripting issue in the system name set.cgi script. Attackers can inject arbitrary script code by manipulating the sysName parameter. A crafted POST request with a malicious script payload is sent, and the payload executes when management pages, including system data.js, are viewed by administrators.

Recommendations Update the firmware to a version newer than 1.00.54.

Correção

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

BDU:2026-03529

CVE-2026-32840

Produtos afetados

Edimax Gs-5008Pl

Referências · 7

• https://bdu.fstec.ru/vul/2026-03529 · Nota de Segurança
• https://edimax.com/edimax/merchandise/merchandise_detail/data/edimax/us/smb_legacy_switches/gs-5008pl · Nota
• https://vulncheck.com/advisories/edimax-gs-5008pl-transmits-credentials-over-cleartext · Nota
• https://vulncheck.com/advisories/edimax-gs-5008pl-stored-xss-via-device-name · Nota
• https://twitter.com/CVEnew/status/2034136466612257040 · Publicação no Twitter
• https://nvd.nist.gov/vuln/detail/CVE-2026-32840 · Nota de Segurança
• https://edimax.com/edimax/merchandise/merchandise_list/data/edimax/us/smb_legacy_products · Nota