Vulnerability CVE-2017-8838
Published: 2017-06-05

Description:
XSS via syncid exists on Peplink Balance 305, 380, 580, 710, 1350, and 2500 devices with firmware before fw-b305hw2_380hw6_580hw2_710hw3_1350hw2_2500-7.0.1-build2093. The affected script is cgi-bin/HASync/hasync.cgi.

See advisories in our WLB2 database:
Topic
Author
Date
Med.
Peplink 7.0.0-build1904 XSS / CSRF / SQL Injection / File Deletion
X41
06.06.2017

CVSS2 => (AV:N/AC:M/Au:N/C:N/I:P/A:N)

CVSS Base Score
Impact Subscore
Exploitability Subscore
4.3/10
2.9/10
8.6/10
Exploit range
Attack complexity
Authentication
Remote
Medium
No required
Confidentiality impact
Integrity impact
Availability impact
None
Partial
None
Affected software
Peplink -> 1350hw2 firmware 
Peplink -> 380hw6 firmware 
Peplink -> 710hw3 firmware 
Peplink -> 580hw2 firmware 
Peplink -> 2500 firmware 
Peplink -> B305hw2 firmware 

 References:
http://seclists.org/bugtraq/2017/Jun/1
https://www.x41-dsec.de/lab/advisories/x41-2017-005-peplink/
Copyright 2024, cxsecurity.com

 

Back to Top