PT-2026-25946 · Edimax · Edimax Gs-5008Pl

Kazuma Matsumoto · Published 2026-03-17 · Updated 2026-03-18 · CVE-2026-32840

Positive Technologies (AI Summary)

CVSS v2.0

5.5

Medium

Base vector

AV:N/AC:L/Au:S/C:P/I:P/A:N

Name of the Vulnerable Software and Affected Versions Edimax GS-5008PL firmware versions prior to 1.00.54

Description The Edimax GS-5008PL firmware contains a stored cross-site scripting issue in the system name set.cgi script. Attackers can inject arbitrary script code by manipulating the sysName parameter. A crafted POST request with a malicious script payload is sent, and the payload executes when management pages, including system data.js, are viewed by administrators.

Recommendations Update the firmware to a version newer than 1.00.54.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

BDU:2026-03529

CVE-2026-32840

Affected Products

Edimax Gs-5008Pl

References · 7

• https://bdu.fstec.ru/vul/2026-03529 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2026-32840 · Security Note
• https://edimax.com/edimax/merchandise/merchandise_detail/data/edimax/us/smb_legacy_switches/gs-5008pl · Note
• https://vulncheck.com/advisories/edimax-gs-5008pl-transmits-credentials-over-cleartext · Note
• https://vulncheck.com/advisories/edimax-gs-5008pl-stored-xss-via-device-name · Note
• https://twitter.com/CVEnew/status/2034136466612257040 · Twitter Post
• https://edimax.com/edimax/merchandise/merchandise_list/data/edimax/us/smb_legacy_products · Note