An issue was discovered in Peplink Balance Two before 8.4.0. Command injection in the traceroute feature of the administration console allows users with admin privileges to execute arbitrary commands as root.
References
Link | Resource |
---|---|
https://www.synacktiv.com/publications%253Ffield_tags_target_id%253D4 | Third Party Advisory |
https://www.synacktiv.com/sites/default/files/2023-12/synacktiv-peplink-multiple-vulnerabilities.pdf | Exploit Third Party Advisory |
Configurations
Configuration 1 (hide)
AND |
|
History
03 Jan 2024, 22:54
Type | Values Removed | Values Added |
---|---|---|
CPE | cpe:2.3:h:peplink:balance_two:-:*:*:*:*:*:*:* cpe:2.3:o:peplink:balance_two_firmware:*:*:*:*:*:*:*:* |
|
CVSS |
v2 : v3 : |
v2 : unknown
v3 : 7.2 |
First Time |
Peplink
Peplink balance Two Peplink balance Two Firmware |
|
CWE | CWE-77 | |
References | () https://www.synacktiv.com/publications%253Ffield_tags_target_id%253D4 - Third Party Advisory | |
References | () https://www.synacktiv.com/sites/default/files/2023-12/synacktiv-peplink-multiple-vulnerabilities.pdf - Exploit, Third Party Advisory |
25 Dec 2023, 08:15
Type | Values Removed | Values Added |
---|---|---|
New CVE |
Information
Published : 2023-12-25 08:15
Updated : 2024-02-28 20:54
NVD link : CVE-2023-49226
Mitre link : CVE-2023-49226
CVE.ORG link : CVE-2023-49226
JSON object : View
Products Affected
peplink
- balance_two
- balance_two_firmware
CWE
CWE-77
Improper Neutralization of Special Elements used in a Command ('Command Injection')