CVE-2017-8839
Medium
Description
XSS via orig_url exists on Peplink Balance 305, 380, 580, 710, 1350, and 2500 devices with firmware before fw-b305hw2_380hw6_580hw2_710hw3_1350hw2_2500-7.0.1-build2093. The affected script is guest/preview.cgi.
SeverityMedium
CVSS6.1
Exploit probability—
ProductPeplink B305hw2 Firmware
PublishedJun 5, 2017
First seenJun 5, 2017
How to fix
Sources list no fixed version or patch link for this vulnerability.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| peplink b305hw2_firmware | 7.0.1 | — |
| peplink 380hw6_firmware | 7.0.1 | — |
| peplink 580hw2_firmware | 7.0.1 | — |
| peplink 710hw3_firmware | 7.0.1 | — |
| peplink 1350hw2_firmware | 7.0.1 | — |
| peplink 2500_firmware | 7.0.1 | — |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.