CVE-2017-8837
CriticalSummary
Cleartext password storage exists on Peplink Balance 305, 380, 580, 710, 1350, and 2500 devices with firmware before version 7.0.1-build2093. The files in question are /etc/waipass and /etc/roapass, which can be easily read by an attacker.
Risk Assessment
If one of these devices is compromised, the attacker can gain access to passwords and abuse them to compromise further systems, posing a serious threat to the organization's security.
Recommendation
It is recommended to update the firmware to version 7.0.1-build2093 or later to eliminate the issue of storing passwords in cleartext.
Other vulnerabilities in Peplink Balance 305, 380, 580, 710, 1350, 2500
See all- CVE-2017-8841High
Arbitrary file deletion exists on Peplink Balance 305, 380, 580, 710, 1350, and 2500 devices with firmware before version 7.0.1-build2093. The attack methodology is absolute path traversal in cgi-bin/MANGA/firmware_process.cgi via the upfile.path parameter.
- CVE-2017-8836High
CSRF exists on Peplink Balance 305, 380, 580, 710, 1350, and 2500 devices with firmware before version 7.0.1-build2093. The CGI scripts in the administrative interface are affected, allowing an attacker to execute commands if a logged-in user visits a malicious website.
- CVE-2017-8835Critical
SQL injection exists on Peplink Balance 305, 380, 580, 710, 1350, and 2500 devices with firmware before version 7.0.1-build2093. An attacker can exploit the bauth cookie to access cgi-bin/MANGA/admin.cgi, allowing for enumeration of user accounts.
Original NVD description (English source)
Cleartext password storage exists on Peplink Balance 305, 380, 580, 710, 1350, and 2500 devices with firmware before fw-b305hw2_380hw6_580hw2_710hw3_1350hw2_2500-7.0.1-build2093. The files in question are /etc/waipass and /etc/roapass. In case one of these devices is compromised, the attacker can gain access to passwords and abuse them to compromise further systems.