PT-2017-18567 · Peplink · Peplink Balance

Published 2017-06-05 · Updated 2019-10-03 · CVE-2017-8837

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Peplink Balance devices (versions prior to 7.0.1-build2093)

Description The issue concerns cleartext password storage. Specifically, the files /etc/waipass and /etc/roapass store passwords in cleartext. If a device is compromised, an attacker can gain access to these passwords and potentially use them to compromise further systems.

Recommendations For Peplink Balance devices with firmware before 7.0.1-build2093, update the firmware to version 7.0.1-build2093 or later to resolve the issue. As a temporary workaround, consider restricting access to the files /etc/waipass and /etc/roapass to minimize the risk of exploitation.

Exploit

Fix

Insufficiently Protected Credentials

Weakness Enumeration

CWE-522

Related Identifiers

CVE-2017-8837

Affected Products

Peplink Balance

References · 5

• 🔥 https://exploit-db.com/exploits/42130 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2017-8837 · Security Note
• https://osv.dev/vulnerability/CVE-2017-8837 · Vendor Advisory
• https://x41-dsec.de/lab/advisories/x41-2017-005-peplink · Patch
• http://seclists.org/bugtraq/2017/Jun/1 · Note