CVE-2026-34127
Gravedad CVSS v4.0:
MEDIA
Tipo:
CWE-79
Neutralización incorrecta de la entrada durante la generación de la página web (Cross-site Scripting)
Fecha de publicación:
29/05/2026
Última modificación:
29/05/2026
Descripción
*** Pendiente de traducción *** A stored<br />
cross-site scripting (XSS) vulnerability has been identified in the web<br />
management interface of TP-Link&#39;s TL-SG108PE v5 switch due to improper sanitation of the SYSNAM<br />
configuration parameter during configuration file import. An attacker with<br />
administrator access can inject malicious script into the device configuration,<br />
which may be stored and executed in the administrator’s browser when the<br />
affected interface is viewed. <br />
<br />
<br />
<br />
<br />
<br />
Successful<br />
exploitation may allow session cookie theft, unauthorized configuration<br />
changes, or access to sensitive information exposed through the management<br />
interface.
Impacto
Puntuación base 4.0
5.30
Gravedad 4.0
MEDIA