Edimax GS-5008PL <= 1.00.54 CSRF via Management CGI Endpoints

The CSRF vulnerability in the Edimax GS-5008PL switch allows an attacker to execute arbitrary administrative actions on behalf of a logged-in user. This includes, but is not limited to, changing administrator passwords, uploading malicious firmware, rebooting the device, performing factory resets, and modifying network configurations. Successful exploitation could lead to a complete compromise of the switch, enabling the attacker to intercept network traffic, disrupt services, or use the switch as a pivot point for further attacks within the network. The lack of proper anti-CSRF protections, such as request validation or CSRF tokens, makes this vulnerability particularly dangerous.

Small and medium-sized businesses (SMBs) that rely on Edimax GS-5008PL switches for their network infrastructure are at significant risk. Organizations with limited security expertise or those using default configurations are particularly vulnerable. Shared hosting environments where multiple customers share the same switch also pose a heightened risk, as a compromised customer could potentially exploit the vulnerability to impact other tenants.

• linux / server:

journalctl -u edimax-gs-5008pl | grep -i "csrf"

• generic web: - Monitor access logs for requests to administrative endpoints (e.g., /admin/passwordreset, /admin/firmwareupload) originating from unusual IP addresses or user agents. - Check response headers for unexpected redirects or changes in session cookies. - Use curl to test for CSRF vulnerabilities by crafting malicious requests and observing the switch's behavior.

1. 2026-03-17Disclosure

   disclosure

1. Gereserveerd2026-03-16
2. Gepubliceerd2026-03-17
3. Gewijzigd2026-05-08
4. EPSS bijgewerkt2026-03-25

The primary mitigation for CVE-2026-32839 is to upgrade the Edimax GS-5008PL switch firmware to version 1.0.55 or later. If an immediate upgrade is not feasible due to compatibility concerns or testing requirements, consider implementing temporary workarounds. These may include restricting administrative access to the switch from untrusted networks, implementing multi-factor authentication (MFA) for administrative accounts, and carefully reviewing any configuration changes made through the web interface. Monitoring network traffic for suspicious requests targeting the switch's administrative interface can also help detect potential exploitation attempts. After upgrading, verify the fix by attempting a CSRF attack via a crafted URL and confirming that the action is denied.