CVE-2026-32841
Edimax GS-5008PL <= 1.00.54 Global Authentication State Across All Clients
- State
- Published
- Severity
- 9.2 Critical
- Published
- Mar 17, 2026
- Updated
- Aug 14, 2026
- Reserved
- Mar 16, 2026
Description
Edimax GS-5008PL firmware versions 1.00.54 and prior contain an authentication bypass vulnerability that allows unauthenticated attackers to access the management interface. Attackers can exploit the global authentication flag mechanism to gain administrative access without credentials after any user authenticates, enabling unauthorized password changes, firmware uploads, and configuration modifications.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 4.0 | 9.2 Critical | CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N | VulnCheck |
| 3.1 | 8.1 High | CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H | VulnCheck |
Weaknesses
- CWE-1108 Excessive Reliance on Global Variables
Affected Products
| Product | Versions |
|---|---|
Edimax GS-5008PLEDIMAX Technology Co., Ltd. |
|
References
- https://www.edimax.com/edimax/merchandise/merchandise_detail/data/edimax/us/smb_legacy_switches/gs-5008pl/product
- https://www.edimax.com/edimax/merchandise/merchandise_list/data/edimax/us/smb_legacy_products/product
- https://www.vulncheck.com/advisories/edimax-gs-5008pl-global-authentication-state-across-all-clientsthird-party-advisory
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.