CVE-2026-32842: Edimax GS-5008PL <= 1.00.54 Admin Credentials Stored in Cleartext
Edimax GS-5008PL firmware version 1.00.54 and prior contain an insecure credential storage vulnerability that allows attackers to obtain administrator credentials by accessing configuration backup files. Attackers can download the config.bin file through fupload.cgi to extract plaintext username and password fields for unauthorized administrative access.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Edimax GS-5008PLto a version that resolves this vulnerability.Fixed in 1.00.54 - Compensating control
Restrict external access to fupload.cgi so attackers cannot download config.bin via fupload.cgi to obtain cleartext administrator credentials.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-32842?
CVE-2026-32842 is classified as a high severity vulnerability due to the risk of unauthorized access to administrator credentials.
How do I fix CVE-2026-32842?
To fix CVE-2026-32842, upgrade the Edimax GS-5008PL firmware to version 1.00.55 or later.
What is the impact of CVE-2026-32842?
The impact of CVE-2026-32842 allows attackers to gain administrator privileges by exploiting the insecure storage of credentials.
Are there any workarounds for CVE-2026-32842?
A potential workaround for CVE-2026-32842 is to secure access to configuration backup files and limit their exposure.
Which devices are affected by CVE-2026-32842?
CVE-2026-32842 affects the Edimax GS-5008PL model with firmware version 1.00.54 and earlier.