TP-Link TL-SG108PE V5 Stored Cross-Site Scripting Vulnerability

A stored cross-site scripting vulnerability has been identified in the web management interface of TP-Link's TL-SG108PE V5 switch. This vulnerability arises from improper sanitation of the SYSNAM configuration parameter during the import of configuration files. An attacker with administrator access can inject malicious scripts into the device's configuration, which may be executed in the administrator's browser when the affected interface is accessed. Exploitation of this vulnerability could lead to session cookie theft, unauthorized configuration changes, or access to sensitive information through the management interface.

Impact

Successful exploitation allows for session cookie theft, unauthorized configuration changes, and access to sensitive information via the management interface.

Remediation

Users are advised to update their devices to the latest firmware version 1.0.1 Build 20260330, available on the TP-Link official website.