CVE-2026-32841: Edimax GS-5008PL <= 1.00.54 Global Authentication State Across All Clients

Severity: high (CVSS 8.1 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.6% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-03-17 · updated 2026-06-17
Weakness: CWE-1108

Description

Edimax GS-5008PL firmware versions 1.00.54 and prior contain an authentication bypass vulnerability that allows unauthenticated attackers to access the management interface. Attackers can exploit the global authentication flag mechanism to gain administrative access without credentials after any user authenticates, enabling unauthorized password changes, firmware uploads, and configuration modifications.

Affected products

EDIMAX Technology Co., Ltd. Edimax GS-5008PL: through 1.00.54

References

https://www.edimax.com/edimax/merchandise/merchandise_detail/data/edimax/us/smb_legacy_switches/gs-5008pl/
https://www.edimax.com/edimax/merchandise/merchandise_list/data/edimax/us/smb_legacy_products/
https://www.vulncheck.com/advisories/edimax-gs-5008pl-global-authentication-state-across-all-clients

Get alerted when CVE-2026-32841 or the next vulnerability affects your stack