This vulnerability is a stored cross-site scripting (CWE-79) issue in TP-Link TL-SG108PE v5 switches. It occurs because the SYSNAM configuration parameter is not properly sanitized during configuration file import, allowing an attacker with administrator access to inject malicious scripts. These scripts are stored in the device configuration and executed in the administrator's browser when the management interface is accessed. The CVSS 4.0 vector indicates the attack requires adjacent network access, low attack complexity, no attack vector, high vulnerability and integrity impact, and partial availability impact. The vulnerability could enable session hijacking, unauthorized changes, or data exposure via the management interface. No patch or official remediation level has been published by TP-Link as of the data provided.

Successful exploitation allows an attacker with administrator privileges to inject and store malicious scripts in the device configuration. When the administrator views the affected interface, these scripts execute in their browser context, potentially leading to session cookie theft, unauthorized configuration changes, or access to sensitive information exposed by the management interface. The impact is limited to administrators with access to the device and the adjacent network environment.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or remediation level is provided, administrators should restrict access to the management interface to trusted personnel only and avoid importing untrusted configuration files. Monitor vendor communications for updates or patches addressing this vulnerability.