Edimax GS‑5008PL switches running firmware 1.00.54 or earlier contain a cross‑site request forgery flaw that lets a remote attacker induce a logged‑in administrator to visit a malicious page and perform unauthorized administrative actions such as changing passwords, uploading firmware, rebooting, performing factory resets, or modifying network configuration. The weakness exists because the device’s management CGI endpoints accept requests without anti‑CSRF tokens or request validation.

Affected devices are Edimax Technology Co., Ltd. Edimax GS‑5008PL switches with firmware version 1.00.54 or earlier.

The CVSS score of 5.1 indicates moderate severity, and the EPSS score of less than 1% suggests a low likelihood that this vulnerability is actively exploited. It is not listed in CISA’s KEV catalog. Exploitation requires a victim administrator to visit a crafted web page, so the attack vector requires remote user interaction and social engineering.