CVE-2026-32839

Description

Edimax GS-5008PL firmware version 1.00.54 and prior contain a cross-site request forgery vulnerability that allows remote attackers to perform unauthorized administrative actions by inducing logged-in administrators to visit malicious pages. Attackers can exploit the lack of anti-CSRF tokens and request validation to change passwords, upload firmware, reboot the device, perform factory resets, or modify network configurations.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

References

• https://www.edimax.com/edimax/merchandise/merchandise_detail/data/edimax/us/smb_legacy_switches/gs-5008pl/ ↗
• https://www.edimax.com/edimax/merchandise/merchandise_list/data/edimax/us/smb_legacy_products/ ↗
• https://www.vulncheck.com/advisories/edimax-gs-5008pl-csrf-via-management-cgi-endpoints ↗