CVE-2026-32840 is a stored cross-site scripting vulnerability affecting Edimax GS-5008PL devices running firmware version 1.00.54 and prior. The vulnerability exists in the system_name_set.cgi script, where improper neutralization of input in the sysName parameter allows injection of arbitrary script code. An attacker with limited privileges can send a crafted POST request containing malicious payload that is stored and later executed when administrative management pages referencing system_data.js are accessed. This can lead to script execution in the context of the administrator's browser session.

Successful exploitation allows an attacker with limited privileges to execute arbitrary scripts in the context of an administrator's session when viewing affected management pages. This could lead to unauthorized actions performed with administrator privileges within the management interface. However, the vulnerability requires user interaction (administrator viewing the page) and limited privileges to exploit, resulting in a medium severity rating.

No official patch or fix is currently available for this vulnerability. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is released, administrators should exercise caution when accessing management pages and avoid interacting with untrusted input. Monitoring vendor communications for updates is recommended.