PT-2017-18571 · Peplink · Peplink Balance

Eric Sesterhenn · Published 2017-06-05 · Updated 2017-08-13 · CVE-2017-8841

Positive Technologies (AI Summary)

CVSS v3.1

8.1

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H

Name of the Vulnerable Software and Affected Versions Peplink Balance devices (305, 380, 580, 710, 1350, and 2500) with firmware before 7.0.1-build2093

Description The issue is related to arbitrary file deletion. It is caused by an absolute path traversal in the "cgi-bin/MANGA/firmware process.cgi" endpoint via the upfile.path parameter.

Recommendations For Peplink Balance devices (305, 380, 580, 710, 1350, and 2500) with firmware before 7.0.1-build2093, update the firmware to version 7.0.1-build2093 or later to resolve the issue. As a temporary workaround, consider restricting access to the "cgi-bin/MANGA/firmware process.cgi" endpoint to minimize the risk of exploitation. Avoid using the upfile.path parameter in the affected endpoint until the issue is resolved.

Exploit

Fix

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2017-8841

Affected Products

Peplink Balance

References · 5

• 🔥 https://exploit-db.com/exploits/42130 · Exploit
• https://osv.dev/vulnerability/CVE-2017-8841 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2017-8841 · Security Note
• http://seclists.org/bugtraq/2017/Jun/1 · Note
• https://x41-dsec.de/lab/advisories/x41-2017-005-peplink · Note