PT-2017-18567 · Peplink · Peplink Balance

Publicado 2017-06-05 · Atualizado 2019-10-03 · CVE-2017-8837

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Crítica

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Peplink Balance devices (versions prior to 7.0.1-build2093)

Description The issue concerns cleartext password storage. Specifically, the files /etc/waipass and /etc/roapass store passwords in cleartext. If a device is compromised, an attacker can gain access to these passwords and potentially use them to compromise further systems.

Recommendations For Peplink Balance devices with firmware before 7.0.1-build2093, update the firmware to version 7.0.1-build2093 or later to resolve the issue. As a temporary workaround, consider restricting access to the files /etc/waipass and /etc/roapass to minimize the risk of exploitation.

Exploit

Correção

Insufficiently Protected Credentials

Enumeração de Fraquezas

CWE-522

Identificadores relacionados

CVE-2017-8837

Produtos afetados

Peplink Balance

Referências · 5

• 🔥 https://exploit-db.com/exploits/42130 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2017-8837 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2017-8837 · Aviso do Fabricante
• http://seclists.org/bugtraq/2017/Jun/1 · Nota
• https://x41-dsec.de/lab/advisories/x41-2017-005-peplink · Correção