Peplink

Records24All Threatist records

Exploited (KEV)0None in CISA KEV

CVSS critical4CVSS 9.0–10.0

CVSS high14CVSS 7.0–8.9

Exploited now

Peplink records in CISA KEV

No Peplink vulnerabilities are listed in CISA KEV.

Components

Products in the NVD configurations · select one to filter the records

1350hw2 Firmware 7 records HIGH 2500 Firmware 7 records HIGH 380hw6 Firmware 7 records HIGH 580hw2 Firmware 7 records HIGH 710hw3 Firmware 7 records HIGH B305hw2 Firmware 7 records HIGH Surf Soho Firmware 7 records HIGH Balance Two Firmware 5 records MEDIUM

Records

24 records

TI-2017-06343 CVE-2017-8835 · GHSA-cwh4-2qh3-3jxc

SQL injection exists on Peplink Balance 305, 380, 580, 710, 1350, and 2500 devices with…

HIGH 77

SQL injection exists on Peplink Balance 305, 380, 580, 710, 1350, and 2500 devices with firmware before fw-b305hw2_380hw6_580hw2_710hw3_1350hw2_2500-7.0.1-build2093.

CVSS 3.0CRITICAL 9.8 Network No auth No interaction EPSS 0.61577 Published 2017-06-05 No fix listed CWE-89

TI-2023-17638 CVE-2023-35194 · GHSA-fm3x-p2hq-hwqw

OS command injection in Peplink Surf SOHO HW1

HIGH 73

An OS command injection vulnerability exists in the api.cgi cmd.mvpn.x509.write functionality of peplink Surf SOHO HW1 v6.3.5 (in QEMU).

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.0519 Published 2023-10-11 No fix listed CWE-78

TI-2023-17637 CVE-2023-35193 · GHSA-hgf2-m7q7-2qmp

OS command injection in Peplink Surf SOHO HW1

HIGH 73

An OS command injection vulnerability exists in the api.cgi cmd.mvpn.x509.write functionality of peplink Surf SOHO HW1 v6.3.5 (in QEMU).

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.0519 Published 2023-10-11 No fix listed CWE-78

TI-2023-17188 CVE-2023-34356 · GHSA-p5qp-xrxv-c8wv

OS command injection in Peplink Surf SOHO HW1

HIGH 73

An OS command injection vulnerability exists in the data.cgi xfer_dns functionality of peplink Surf SOHO HW1 v6.3.5 (in QEMU).

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.05105 Published 2023-10-11 No fix listed CWE-78

TI-2023-12927 CVE-2023-28381 · GHSA-x6x8-jpgv-4ggp

OS command injection in Peplink Surf SOHO HW1

HIGH 73

An OS command injection vulnerability exists in the admin.cgi MVPN_trial_init functionality of peplink Surf SOHO HW1 v6.3.5 (in QEMU).

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.06073 Published 2023-10-11 No fix listed CWE-78

TI-2023-12114 CVE-2023-27380 · GHSA-726f-hhr3-x9g3

OS command injection in Peplink Surf SOHO HW1

HIGH 73

An OS command injection vulnerability exists in the admin.cgi USSD_send functionality of peplink Surf SOHO HW1 v6.3.5 (in QEMU).

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.05905 Published 2023-10-11 No fix listed CWE-78

TI-2023-20506 CVE-2023-39367 · GHSA-r4rf-j49f-c6q2

OS command injection in Peplink Smart Reader

HIGH 68

An OS command injection vulnerability exists in the web interface mac2name functionality of Peplink Smart Reader v1.2.0 (in QEMU).

CVSS 3.1CRITICAL 9.1 Network High privileges No interaction EPSS 0.37678 Published 2024-04-17 No fix listed CWE-78

TI-2026-41699 CVE-2026-57920 · GHSA-69xh-mqwf-cxv2

Peplink InControl 2 through 2.14.2 before 2026-06-03 allows use of a semicolon to bypass…

HIGH 67

Peplink InControl 2 through 2.14.2 before 2026-06-03 allows use of a semicolon to bypass access-control rules for certain /rest/o/{orgId} endpoints.

CVSS 3.1HIGH 7.7 Network Low privileges No interaction EPSS 0.00377 Published 2026-06-26 Fixed in 2026-06-03 CWE-551

TI-2023-26871 CVE-2023-49228 · GHSA-9vmm-rq94-phr7

An issue was discovered in Peplink Balance Two before 8.4.0.

MEDIUM 64

An issue was discovered in Peplink Balance Two before 8.4.0.

CVSS 3.1MEDIUM 6.4 Physical No auth No interaction EPSS 0.00473 Published 2023-12-28 No fix listed CWE-798

TI-2023-17186 CVE-2023-34354 · GHSA-qr2h-wj83-58jc

Cross-site scripting in Peplink Surf SOHO HW1

MEDIUM 58

A stored cross-site scripting (XSS) vulnerability exists in the upload_brand.cgi functionality of peplink Surf SOHO HW1 v6.3.5 (in QEMU).

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.00814 Published 2023-10-11 No fix listed CWE-80

TI-2017-06345 CVE-2017-8837 · GHSA-wq46-f9c9-c555

Cleartext password storage exists on Peplink Balance 305, 380, 580, 710, 1350, and 2500…

MEDIUM 50

Cleartext password storage exists on Peplink Balance 305, 380, 580, 710, 1350, and 2500 devices with firmware before fw-b305hw2_380hw6_580hw2_710hw3_1350hw2_2500-7.0.1-build2093.

CVSS 3.0CRITICAL 9.8 Network No auth No interaction EPSS 0.04943 Published 2017-06-05 No fix listed CWE-522

TI-2023-21025 CVE-2023-40146 · GHSA-rgm2-gvmf-vqr7

Command injection in Peplink Smart Reader

MEDIUM 46

A privilege escalation vulnerability exists in the /bin/login functionality of Peplink Smart Reader v1.2.0 (in QEMU).

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.01435 Published 2024-04-17 No fix listed CWE-77

TI-2023-26873 CVE-2023-49230 · GHSA-jx5r-5mcr-7q4g

An issue was discovered in Peplink Balance Two before 8.4.0.

MEDIUM 42

An issue was discovered in Peplink Balance Two before 8.4.0.

CVSS 3.1HIGH 8.8 Network No auth User interaction EPSS 0.0205 Published 2023-12-28 No fix listed CWE-862

TI-2023-24220 CVE-2023-45209 · GHSA-597x-3rj2-4p53

Improper access control in Peplink Smart Reader

MEDIUM 42

An information disclosure vulnerability exists in the web interface /cgi-bin/download_config.cgi functionality of Peplink Smart Reader v1.2.0 (in QEMU).

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.01381 Published 2024-04-17 No fix listed CWE-284

TI-2023-23248 CVE-2023-43491 · GHSA-mxrq-w7rf-pf56

Improper access control in Peplink Smart Reader

MEDIUM 42

An information disclosure vulnerability exists in the web interface /cgi-bin/debug_dump.cgi functionality of Peplink Smart Reader v1.2.0 (in QEMU).

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.01485 Published 2024-04-17 No fix listed CWE-284

TI-2017-06349 CVE-2017-8841 · GHSA-c522-v393-67mg

Arbitrary file deletion exists on Peplink Balance 305, 380, 580, 710, 1350, and 2500…

MEDIUM 42

Arbitrary file deletion exists on Peplink Balance 305, 380, 580, 710, 1350, and 2500 devices with firmware before fw-b305hw2_380hw6_580hw2_710hw3_1350hw2_2500-7.0.1-build2093.

CVSS 3.0HIGH 8.1 Network Low privileges No interaction EPSS 0.03712 Published 2017-06-05 No fix listed CWE-22

TI-2017-06344 CVE-2017-8836 · GHSA-2mwj-jf28-g57f

CSRF exists on Peplink Balance 305, 380, 580, 710, 1350, and 2500 devices with firmware…

MEDIUM 42

CSRF exists on Peplink Balance 305, 380, 580, 710, 1350, and 2500 devices with firmware before fw-b305hw2_380hw6_580hw2_710hw3_1350hw2_2500-7.0.1-build2093.

CVSS 3.0HIGH 8.8 Network No auth User interaction EPSS 0.01873 Published 2017-06-05 No fix listed CWE-352

TI-2023-24518 CVE-2023-45744 · GHSA-rch5-h93g-8v3q

Improper access control in Peplink Smart Reader

MEDIUM 41

A data integrity vulnerability exists in the web interface /cgi-bin/upload_config.cgi functionality of Peplink Smart Reader v1.2.0 (in QEMU).

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.01305 Published 2024-04-17 No fix listed CWE-284

TI-2023-26870 CVE-2023-49226 · GHSA-j3jw-c3vp-jg36

An issue was discovered in Peplink Balance Two before 8.4.0.

LOW 38

An issue was discovered in Peplink Balance Two before 8.4.0.

CVSS 3.1HIGH 7.2 Network High privileges No interaction EPSS 0.03423 Published 2023-12-25 No fix listed CWE-77

TI-2020-14857 CVE-2020-24246 · GHSA-873q-6mjj-g9m5

Peplink Balance before 8.1.0rc1 allows an unauthenticated attacker to download PHP…

LOW 35

Peplink Balance before 8.1.0rc1 allows an unauthenticated attacker to download PHP configuration files (/filemanager/php/connector.php) from Web Admin.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.01281 Published 2020-10-07 No fix listed

TI-2017-06347 CVE-2017-8839 · GHSA-qrf5-g9cq-r2h6

XSS via orig_url exists on Peplink Balance 305, 380, 580, 710, 1350, and 2500 devices…

LOW 31

XSS via orig_url exists on Peplink Balance 305, 380, 580, 710, 1350, and 2500 devices with firmware before fw-b305hw2_380hw6_580hw2_710hw3_1350hw2_2500-7.0.1-build2093.

CVSS 3.0MEDIUM 6.1 Network No auth User interaction EPSS 0.01756 Published 2017-06-05 No fix listed CWE-79

TI-2017-06346 CVE-2017-8838 · GHSA-4m44-9r37-q4q5

XSS via syncid exists on Peplink Balance 305, 380, 580, 710, 1350, and 2500 devices with…

LOW 31

XSS via syncid exists on Peplink Balance 305, 380, 580, 710, 1350, and 2500 devices with firmware before fw-b305hw2_380hw6_580hw2_710hw3_1350hw2_2500-7.0.1-build2093.

CVSS 3.0MEDIUM 6.1 Network No auth User interaction EPSS 0.01794 Published 2017-06-05 No fix listed CWE-79

TI-2017-06348 CVE-2017-8840 · GHSA-5p89-g4ff-g7j6

Debug information disclosure exists on Peplink Balance 305, 380, 580, 710, 1350, and 2500…

LOW 30

Debug information disclosure exists on Peplink Balance 305, 380, 580, 710, 1350, and 2500 devices with firmware before fw-b305hw2_380hw6_580hw2_710hw3_1350hw2_2500-7.0.1-build2093.

CVSS 3.0MEDIUM 5.3 Network No auth No interaction EPSS 0.03568 Published 2017-06-05 No fix listed CWE-200

TI-2023-26872 CVE-2023-49229 · GHSA-3q89-rj9x-cm52

An issue was discovered in Peplink Balance Two before 8.4.0.

LOW 21

An issue was discovered in Peplink Balance Two before 8.4.0.

CVSS 3.1MEDIUM 4.3 Network Low privileges No interaction EPSS 0.00488 Published 2023-12-28 No fix listed CWE-862

Open these records in search →