CVE-2017-8841
HighSummary
Arbitrary file deletion exists on Peplink Balance 305, 380, 580, 710, 1350, and 2500 devices with firmware before version 7.0.1-build2093. The attack methodology is absolute path traversal in cgi-bin/MANGA/firmware_process.cgi via the upfile.path parameter.
Risk Assessment
This vulnerability may lead to unauthorized file deletion, impacting system integrity and data availability. Organizations could face loss of critical information and service disruptions.
Recommendation
It is recommended to update the firmware to version 7.0.1-build2093 or later to mitigate this vulnerability. Additionally, monitoring and restricting access to critical system resources is advisable.
Other vulnerabilities in Peplink Balance 305, 380, 580, 710, 1350, 2500
See all- CVE-2017-8836High
CSRF exists on Peplink Balance 305, 380, 580, 710, 1350, and 2500 devices with firmware before version 7.0.1-build2093. The CGI scripts in the administrative interface are affected, allowing an attacker to execute commands if a logged-in user visits a malicious website.
- CVE-2017-8837Critical
Cleartext password storage exists on Peplink Balance 305, 380, 580, 710, 1350, and 2500 devices with firmware before version 7.0.1-build2093. The files in question are /etc/waipass and /etc/roapass, which can be easily read by an attacker.
- CVE-2017-8835Critical
SQL injection exists on Peplink Balance 305, 380, 580, 710, 1350, and 2500 devices with firmware before version 7.0.1-build2093. An attacker can exploit the bauth cookie to access cgi-bin/MANGA/admin.cgi, allowing for enumeration of user accounts.
Original NVD description (English source)
Arbitrary file deletion exists on Peplink Balance 305, 380, 580, 710, 1350, and 2500 devices with firmware before fw-b305hw2_380hw6_580hw2_710hw3_1350hw2_2500-7.0.1-build2093. The attack methodology is absolute path traversal in cgi-bin/MANGA/firmware_process.cgi via the upfile.path parameter.