CVE-2017-8836
High
Description
CSRF exists on Peplink Balance 305, 380, 580, 710, 1350, and 2500 devices with firmware before fw-b305hw2_380hw6_580hw2_710hw3_1350hw2_2500-7.0.1-build2093. The CGI scripts in the administrative interface are affected. This allows an attacker to execute commands, if a logged in user visits a malicious website. This can for example be used to change the credentials of the administrative webinterface.
SeverityHigh
CVSS8.8
Exploit probability—
ProductPeplink B305hw2 Firmware
PublishedJun 5, 2017
First seenJun 5, 2017
How to fix
Sources list no fixed version or patch link for this vulnerability.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| peplink b305hw2_firmware | 7.0.1 | — |
| peplink 380hw6_firmware | 7.0.1 | — |
| peplink 580hw2_firmware | 7.0.1 | — |
| peplink 710hw3_firmware | 7.0.1 | — |
| peplink 1350hw2_firmware | 7.0.1 | — |
| peplink 2500_firmware | 7.0.1 | — |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.