TP-Link TL-SG108PE CVE-2026-34127

Exploitation requires all of the following conditions simultaneously: (1) The attacker must be on an adjacent network (AV:A from CVSS 4.0) - specifically the same LAN, VLAN, or management network segment as the switch's web management interface; remote internet-based exploitation is not possible without prior network access. (2) The attacker must possess or have stolen administrator-level credentials to the switch management interface (PR:H from CVSS 4.0) - lower-privilege or unauthenticated access is insufficient to perform the configuration import operation. (3) The configuration file import feature must be available and not disabled. (4) A second, legitimate administrator must passively view the management page that renders the SYSNAM parameter (UI:P from CVSS 4.0) - the attacker cannot force execution autonomously. Factors limiting exploitation: high privilege requirement prevents opportunistic unauthenticated attacks; adjacency requirement prevents direct internet exploitation; passive user interaction requirement introduces timing uncertainty. The vulnerability does NOT require any non-default configuration - the web management interface and configuration import are standard features of this device.

The CVSS 4.0 base score of 5.3 (Medium) is shaped primarily by three constraining factors in the vector: AV:A (adjacent network - attacker must be on the same LAN or VLAN as the switch's management interface), PR:H (high privileges - administrator credentials are required), and UI:P (passive user interaction - a second administrator must view the affected page for execution). These factors significantly reduce real-world risk compared to a fully remote, unauthenticated XSS. The confidentiality sub-score VC:H and VA:H reflect meaningful impact if exploitation succeeds - session theft and potential availability disruption - but these are conditional on the multi-step prerequisites being met. SSVC corroborates this: exploitation status is rated none, the attack is not automatable, and technical impact is partial. No CISA KEV listing and no public exploit code further reduce urgency. The primary realistic threat is a rogue insider or a compromised administrator account on the management VLAN using this flaw to pivot laterally via stolen session cookies. For organizations with strict management network segmentation and role-based access control, the practical risk is low; for flat networks where the management interface is broadly reachable, the risk is moderately elevated.

An attacker who has obtained administrator credentials to the TL-SG108PE v5 management interface - either through credential theft, phishing, or a compromised management workstation on the same network segment - crafts a device configuration file in which the SYSNAM field contains a malicious JavaScript payload. The attacker imports this configuration via the web interface, causing the script to be stored persistently on the device. When a legitimate administrator subsequently views the management page that renders the SYSNAM value, the script executes in their browser, exfiltrating the session cookie to an attacker-controlled endpoint and enabling full session hijacking. No public proof-of-concept code has been identified, but the attack technique is well-understood and follows standard stored XSS patterns.