CVE-2017-8835

SQL injection exists on Peplink Balance 305, 380, 580, 710, 1350, and 2500 devices with firmware before fw-b305hw2_380hw6_580hw2_710hw3_1350hw2_2500-7.0.1-build2093. An attack vector is the bauth cookie to cgi-bin/MANGA/admin.cgi. One impact is enumeration of user accounts by observing whether a session ID can be retrieved from the sessions database.
Configurations

Configuration 1 (hide)

AND
cpe:2.3:o:peplink:b305hw2_firmware:7.0.1:*:*:*:*:*:*:*
cpe:2.3:h:peplink:balance_305:-:*:*:*:*:*:*:*

Configuration 2 (hide)

AND
cpe:2.3:o:peplink:380hw6_firmware:7.0.1:*:*:*:*:*:*:*
cpe:2.3:h:peplink:balance_380:-:*:*:*:*:*:*:*

Configuration 3 (hide)

AND
cpe:2.3:o:peplink:580hw2_firmware:7.0.1:*:*:*:*:*:*:*
cpe:2.3:h:peplink:balance_580:-:*:*:*:*:*:*:*

Configuration 4 (hide)

AND
cpe:2.3:o:peplink:710hw3_firmware:7.0.1:*:*:*:*:*:*:*
cpe:2.3:h:peplink:balance_710:-:*:*:*:*:*:*:*

Configuration 5 (hide)

AND
cpe:2.3:o:peplink:1350hw2_firmware:7.0.1:*:*:*:*:*:*:*
cpe:2.3:h:peplink:balance_1350:-:*:*:*:*:*:*:*

Configuration 6 (hide)

AND
cpe:2.3:o:peplink:2500_firmware:7.0.1:*:*:*:*:*:*:*
cpe:2.3:h:peplink:balance_2500:-:*:*:*:*:*:*:*

History

21 Nov 2024, 03:34

Type Values Removed Values Added
References () http://seclists.org/bugtraq/2017/Jun/1 - Mailing List, Third Party Advisory () http://seclists.org/bugtraq/2017/Jun/1 - Mailing List, Third Party Advisory
References () https://www.exploit-db.com/exploits/42130/ - () https://www.exploit-db.com/exploits/42130/ -
References () https://www.x41-dsec.de/lab/advisories/x41-2017-005-peplink/ - Patch, Third Party Advisory () https://www.x41-dsec.de/lab/advisories/x41-2017-005-peplink/ - Patch, Third Party Advisory

Information

Published : 2017-06-05 14:29

Updated : 2024-11-21 03:34


NVD link : CVE-2017-8835

Mitre link : CVE-2017-8835

CVE.ORG link : CVE-2017-8835


JSON object : View

Products Affected

peplink

  • balance_380
  • 710hw3_firmware
  • 1350hw2_firmware
  • balance_710
  • balance_1350
  • balance_305
  • 380hw6_firmware
  • b305hw2_firmware
  • 580hw2_firmware
  • balance_2500
  • 2500_firmware
  • balance_580
CWE
CWE-89

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')