Stored Cross-Site Scripting Vulnerability in TP-Link TL-SG108PE Switch

CVE-2026-34127

What is CVE-2026-34127?

A stored cross-site scripting vulnerability exists within the web management interface of TP-Link's TL-SG108PE v5 switch. This flaw arises from insufficient sanitization of the SYSNAME configuration parameter during the import of configuration files. An authenticated attacker with administrative access can inject malicious scripts into the device's configuration, which are subsequently stored and executed in the browser of any administrator accessing the interface. The exploitation of this vulnerability can lead to session cookie theft, unauthorized modifications to configurations, and exposure of sensitive information accessible through the management interface.

References