PT-2023-31121 · Peplink · Peplink Balance Two

CVE-2023-49228 · Publicado 2023-12-07 · Atualizado 2024-01-04

Positive Technologies (AI Summary)

CVSS v3.1

6.4

Média

Vetor base

AV:P/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Peplink Balance Two versions prior to 8.4.0

Description An issue was discovered in Peplink Balance Two where console port authentication uses hard-coded credentials. This allows an attacker with physical access and sufficient knowledge to execute arbitrary commands as root.

Recommendations For Peplink Balance Two versions prior to 8.4.0, update to version 8.4.0 or later to resolve the issue. As a temporary workaround, consider restricting physical access to the console port to minimize the risk of exploitation.

Exploit

Correção

Using Hardcoded Credentials

Enumeração de Fraquezas

CWE-798

Identificadores relacionados

CVE-2023-49228

Produtos afetados

Peplink Balance Two

Referências · 9

• 🔥 https://synacktiv.com/sites/default/files/2023-12/synacktiv-peplink-multiple-vulnerabilities.pdf · Exploit
• https://osv.dev/vulnerability/CVE-2023-49228 · Aviso do Fabricante
• https://t.me/cvenotify/66235 · Publicação no Telegram
• https://twitter.com/CVEnew/status/1740212885136212360 · Publicação no Twitter
• https://twitter.com/VulmonFeeds/status/1740263218906374207 · Publicação no Twitter
• https://t.me/cvenotify/65340 · Publicação no Telegram
• https://synacktiv.com/publications%253Ffield_tags_target_id%253D4 · Nota
• https://twitter.com/Synacktiv/status/1732817027901821084 · Publicação no Twitter
• https://nvd.nist.gov/vuln/detail/CVE-2023-49228 · Nota de Segurança