A stored cross‑site scripting flaw exists in the configuration file import feature of TP‑Link’s TL‑SG108PE v5 switch. The flaw stems from unsanitized handling of the SYSNAM configuration field, allowing an attacker with administrator privileges to inject malicious JavaScript that is stored and later executed in any administrator’s browser when the configuration interface is viewed. The injected script can steal session cookies, modify device settings without approval, or expose protected data through the management portal.

The vulnerability affects TP‑Link Systems Inc.’s TL‑SG108PE switch running firmware version 5. No other vendors or products are listed.

The CVSS score of 5.3 indicates a moderate severity. Because EPSS is unavailable and the vulnerability is not catalogued in CISA KEV, the likelihood of widespread exploitation appears limited. However, the attack requires initial administrative access to upload a malicious configuration file, after which any logged‑in administrator could have their session hijacked or device settings altered. With remote management enabled, attackers could potentially reach the admin interface without physical presence, increasing the practical risk.