CVE-2020-24246
High
Description
Peplink Balance before 8.1.0rc1 allows an unauthenticated attacker to download PHP configuration files (/filemanager/php/connector.php) from Web Admin.
SeverityHigh
CVSS7.5
Exploit probability—
ProductPeplink Balance 20x Firmware
PublishedOct 7, 2020
First seenOct 7, 2020
How to fix
Sources list no fixed version or patch link for this vulnerability.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| peplink balance_20x_firmware | v ≤ 8.1.0 | — |
| peplink balance_310x_firmware | v ≤ 8.1.0 | — |
| peplink mbx_firmware | v ≤ 8.1.0 | — |
| peplink epx_firmware | v ≤ 8.1.0 | — |
| peplink sdx_firmware | v ≤ 8.1.0 | — |
| peplink balance_30_lte_firmware | v ≤ 8.1.0 | — |
| peplink balance_20_firmware | v ≤ 8.1.0 | — |
| peplink balance_30_firmware | v ≤ 8.1.0 | — |
| peplink balance_30_pro_firmware | v ≤ 8.1.0 | — |
| peplink balance_50_firmware | v ≤ 8.1.0 | — |
| peplink balance_one_firmware | v ≤ 8.1.0 | — |
| peplink balance_two_firmware | v ≤ 8.1.0 | — |
| peplink balance_210_firmware | v ≤ 8.1.0 | — |
| peplink balance_310_firmware | v ≤ 8.1.0 | — |
| peplink balance_305_firmware | v ≤ 8.1.0 | — |
| peplink balance_380_firmware | v ≤ 8.1.0 | — |
| peplink balance_580_firmware | v ≤ 8.1.0 | — |
| peplink balance_710_firmware | v ≤ 8.1.0 | — |
| peplink balance_1350_firmware | v ≤ 8.1.0 | — |
| peplink balance_2500_firmware | v ≤ 8.1.0 | — |
| peplink max_br1_mk2_firmware | v ≤ 8.1.0 | — |
| peplink max_br1_classic_firmware | v ≤ 8.1.0 | — |
| peplink max_br1_slim_firmware | v ≤ 8.1.0 | — |
| peplink max_br1_mini_firmware | v ≤ 8.1.0 | — |
| peplink max_br1_m2m_firmware | v ≤ 8.1.0 | — |
| peplink max_br1_ent_firmware | v ≤ 8.1.0 | — |
| peplink max_br1_pro_firmware | v ≤ 8.1.0 | — |
| peplink max_br1__ip67_firmware | v ≤ 8.1.0 | — |
| peplink max_br2_firmware | v ≤ 8.1.0 | — |
| peplink max_br1_ip55_firmware | v ≤ 8.1.0 | — |
| peplink max_br2_ip55_firmware | v ≤ 8.1.0 | — |
| peplink max_hd2_ip67_firmware | v ≤ 8.1.0 | — |
| peplink max_hd2_mini_firmware | v ≤ 8.1.0 | — |
| peplink max_hd2_firmware | v ≤ 8.1.0 | — |
| peplink max_hd1_dome_firmware | v ≤ 8.1.0 | — |
| peplink max_hd2_dome_firmware | v ≤ 8.1.0 | — |
| peplink max_hd4_firmware | v ≤ 8.1.0 | — |
| peplink max_hd4_ip67_firmware | v ≤ 8.1.0 | — |
| peplink max_transit_firmware | v ≤ 8.1.0 | — |
| peplink max_transit_duo_firmware | v ≤ 8.1.0 | — |
| peplink max_transit_mini_firmware | v ≤ 8.1.0 | — |
| peplink max_hotspot_firmware | v ≤ 8.1.0 | — |
| peplink max_on-the-go_firmware | v ≤ 8.1.0 | — |
| peplink max_700_firmware | v ≤ 8.1.0 | — |
| peplink ubr_lte_firmware | v ≤ 8.1.0 | — |
| peplink surf_soho_firmware | v ≤ 8.1.0 | — |
| peplink surf_soho_mk3_firmware | v ≤ 8.1.0 | — |
| peplink mediafast_200_firmware | v ≤ 8.1.0 | — |
| peplink mediafast_500_firmware | v ≤ 8.1.0 | — |
| peplink mediafast_750_firmware | v ≤ 8.1.0 | — |
| peplink mediafast_hd2_firmware | v ≤ 8.1.0 | — |
| peplink mediafast_hd4_firmware | v ≤ 8.1.0 | — |
| peplink speedfusion_sfe_firmware | v ≤ 8.1.0 | — |
| peplink speedfusion_sfe_cam_firmware | v ≤ 8.1.0 | — |
| peplink fusionhub_firmware | v ≤ 8.1.0 | — |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.