PT-2023-31120 · Peplink · Peplink Balance

Published 2023-12-07 · Updated 2024-01-03 · CVE-2023-49226

Positive Technologies (AI Summary)

CVSS v3.1

7.2

High

Base vector

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Peplink Balance Two versions prior to 8.4.0

Description An issue was discovered in the traceroute feature of the administration console, allowing command injection. This enables users with admin privileges to execute arbitrary commands as root.

Recommendations For versions prior to 8.4.0, update to version 8.4.0 or later to resolve the issue. As a temporary workaround, consider restricting access to the administration console and the traceroute feature to minimize the risk of exploitation.

Exploit

Fix

Command Injection

Weakness Enumeration

CWE-77

Related Identifiers

CVE-2023-49226

Affected Products

Peplink Balance

References · 9

• 🔥 https://synacktiv.com/sites/default/files/2023-12/synacktiv-peplink-multiple-vulnerabilities.pdf · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2023-49226 · Security Note
• https://osv.dev/vulnerability/CVE-2023-49226 · Vendor Advisory
• https://t.me/cvenotify/66132 · Telegram Post
• https://twitter.com/CVEnew/status/1739199220324642968 · Twitter Post
• https://t.me/cvenotify/65106 · Telegram Post
• https://synacktiv.com/publications%253Ffield_tags_target_id%253D4 · Note
• https://twitter.com/Synacktiv/status/1732817027901821084 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1739246738643267943 · Twitter Post