CVE-2017-8835

Critical

Published: 05/06/2017(UTC)Translated: 14/06/2026(UTC)NVD NIST

Summary

SQL injection exists on Peplink Balance 305, 380, 580, 710, 1350, and 2500 devices with firmware before version 7.0.1-build2093. An attacker can exploit the bauth cookie to access cgi-bin/MANGA/admin.cgi, allowing for enumeration of user accounts.

Risk Assessment

This vulnerability may lead to the exposure of user account information, posing a risk of unauthorized access to the system. Organizations should be aware of potential data security threats.

Recommendation

It is recommended to update the firmware to version 7.0.1-build2093 or later to mitigate this vulnerability. Additionally, monitoring access logs for potential attack attempts is advisable.

Original NVD description (English source)

SQL injection exists on Peplink Balance 305, 380, 580, 710, 1350, and 2500 devices with firmware before fw-b305hw2_380hw6_580hw2_710hw3_1350hw2_2500-7.0.1-build2093. An attack vector is the bauth cookie to cgi-bin/MANGA/admin.cgi. One impact is enumeration of user accounts by observing whether a session ID can be retrieved from the sessions database.