CVE-2017-8837
Critical
Description
Cleartext password storage exists on Peplink Balance 305, 380, 580, 710, 1350, and 2500 devices with firmware before fw-b305hw2_380hw6_580hw2_710hw3_1350hw2_2500-7.0.1-build2093. The files in question are /etc/waipass and /etc/roapass. In case one of these devices is compromised, the attacker can gain access to passwords and abuse them to compromise further systems.
SeverityCritical
CVSS9.8
Exploit probability—
ProductPeplink B305hw2 Firmware
PublishedJun 5, 2017
First seenJun 5, 2017
How to fix
Sources list no fixed version or patch link for this vulnerability.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| peplink b305hw2_firmware | 7.0.1 | — |
| peplink 380hw6_firmware | 7.0.1 | — |
| peplink 580hw2_firmware | 7.0.1 | — |
| peplink 710hw3_firmware | 7.0.1 | — |
| peplink 1350hw2_firmware | 7.0.1 | — |
| peplink 2500_firmware | 7.0.1 | — |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.