An issue was discovered in Peplink Balance Two before 8.4.0. Command injection in the traceroute feature of the administration console allows users with admin privileges to execute arbitrary commands as root.
References
Link | Resource |
---|---|
https://www.synacktiv.com/publications%253Ffield_tags_target_id%253D4 | Third Party Advisory |
https://www.synacktiv.com/sites/default/files/2023-12/synacktiv-peplink-multiple-vulnerabilities.pdf | Exploit Third Party Advisory |
Configurations
Configuration 1 (hide)
AND |
|
History
03 Jan 2024, 22:54
Type | Values Removed | Values Added |
---|---|---|
CWE | CWE-77 | |
CVSS |
v2 : v3 : |
v2 : unknown
v3 : 7.2 |
First Time |
Peplink balance Two Firmware
Peplink Peplink balance Two |
|
CPE | cpe:2.3:o:peplink:balance_two_firmware:*:*:*:*:*:*:*:* cpe:2.3:h:peplink:balance_two:-:*:*:*:*:*:*:* |
|
References | () https://www.synacktiv.com/publications%253Ffield_tags_target_id%253D4 - Third Party Advisory | |
References | () https://www.synacktiv.com/sites/default/files/2023-12/synacktiv-peplink-multiple-vulnerabilities.pdf - Exploit, Third Party Advisory |
26 Dec 2023, 20:34
Type | Values Removed | Values Added |
---|---|---|
Summary |
|
25 Dec 2023, 08:15
Type | Values Removed | Values Added |
---|---|---|
New CVE |
Information
Published : 2023-12-25 08:15
Updated : 2024-01-03 22:54
NVD link : CVE-2023-49226
Mitre link : CVE-2023-49226
CVE.ORG link : CVE-2023-49226
JSON object : View
Products Affected
peplink
- balance_two_firmware
- balance_two
CWE
CWE-77
Improper Neutralization of Special Elements used in a Command ('Command Injection')