The vulnerability is an insecure credential storage flaw that allows an attacker to download the configuration backup file (config.bin) through the fupload.cgi endpoint and then extract the plaintext username and password fields embedded within it. This provides a mechanism for obtaining valid administrative credentials, which can be used to access the device’s web‑based management interface with full privileges. The weakness corresponds to CWE‑312, Plaintext Storage of Sensitive Information.

Affected vendor: EDIMAX Technology Co., Ltd. Product: Edimax GS‑5008PL. Firmware versions 1.00.54 and earlier are vulnerable; versions newer than 1.00.54 are presumed not to contain the flaw.

The CVSS base score is 7.1, indicating a high severity level. The EPSS score is reported as less than 1%, suggesting a low likelihood of widespread exploitation at present. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. Based on the description, the attacker can obtain credentials via the device’s web interface, typically by accessing the fupload.cgi endpoint without needing pre‑existing authentication. Thus, the attack vector is a local or remote web‑based request, and the exploitation path is straightforward: download config.bin, parse the plaintext fields, and use the extracted credentials to gain administrative control.