HIGH🇵🇱 Wersja polska

CVE-2023-49226

CVSS 7.2v3.1pub. 2023-12-25upd. 2024-11-21

An issue was discovered in Peplink Balance Two before 8.4.0. Command injection in the traceroute feature of the administration console allows users with admin privileges to execute arbitrary commands as root.

CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

  • Peplink Balance Two

    HW
    Peplink
    all versions

  • Peplink Balance Two Firmware

    OS
    Peplink
    < 8.4.0
🔵
CHECK WITH VENDOR
No clear patch data available. Check vendor references.
CWE
References

Related vulnerabilities

CVE-2023-49230HIGH8.8same product

An issue was discovered in Peplink Balance Two before 8.4.0. A missing authorization check in captive portals ...

CVE-2020-24246HIGH7.5same product

Peplink Balance before 8.1.0rc1 allows an unauthenticated attacker to download PHP configuration files (/filem...

CVE-2023-49228MEDIUM6.4same product

An issue was discovered in Peplink Balance Two before 8.4.0. Console port authentication uses hard-coded crede...

CVE-2023-49229MEDIUM4.3same product

An issue was discovered in Peplink Balance Two before 8.4.0. A missing authorization check in the administrati...

CVE-2023-39367CRITICAL9.1PL ✓same vendor

OS command injection w interfejsie web Peplink Smart Reader (mac2name)