CVE-2026-32839: CSRF in Edimax GS-5008PL Switch

The CSRF vulnerability in the Edimax GS-5008PL switch allows an attacker to execute arbitrary administrative actions on behalf of a logged-in user. This includes, but is not limited to, changing administrator passwords, uploading malicious firmware, rebooting the device, performing factory resets, and modifying network configurations. Successful exploitation could lead to a complete compromise of the switch, enabling the attacker to intercept network traffic, disrupt services, or use the switch as a pivot point for further attacks within the network. The lack of proper anti-CSRF protections, such as request validation or CSRF tokens, makes this vulnerability particularly dangerous.

1. Reserved2026-03-16
2. Published2026-03-17
3. Modified2026-05-08
4. EPSS updated2026-03-25

The primary mitigation for CVE-2026-32839 is to upgrade the Edimax GS-5008PL switch firmware to version 1.0.55 or later. If an immediate upgrade is not feasible due to compatibility concerns or testing requirements, consider implementing temporary workarounds. These may include restricting administrative access to the switch from untrusted networks, implementing multi-factor authentication (MFA) for administrative accounts, and carefully reviewing any configuration changes made through the web interface. Monitoring network traffic for suspicious requests targeting the switch's administrative interface can also help detect potential exploitation attempts. After upgrading, verify the fix by attempting a CSRF attack via a crafted URL and confirming that the action is denied.