CVE-2026-32842 affects Edimax GS-5008PL devices running firmware version 1.00.54 or earlier. The vulnerability arises from insecure storage of administrator credentials in the configuration backup file (config.bin), which can be downloaded via the fupload.cgi interface. This allows an attacker with network access to retrieve the config.bin file and extract plaintext username and password fields, leading to unauthorized administrative control of the device. The vulnerability is categorized under CWE-312 and has a CVSS 4.0 score of 7.1, reflecting a high risk due to network attack vector, low attack complexity, and no required privileges or user interaction.

Successful exploitation allows an attacker to obtain administrator credentials in plaintext, resulting in unauthorized administrative access to the affected device. This can lead to full control over device configuration and potentially compromise network security. The vulnerability does not require user interaction or elevated privileges to exploit, increasing its risk profile. No known exploits have been reported in the wild.

No official patch or remediation is currently available from the vendor. Users should monitor the vendor's advisory channels for updates and consider restricting access to the device management interface and the fupload.cgi endpoint to trusted networks only. Until a fix is released, limiting network exposure of the device and disabling remote configuration backups if possible are recommended to reduce risk.