Skip to content
Noroxi

Peplink records

24 published records for vendor peplink.

Researcher profile

Entered KEV
0 · 0%
Weaponized
1 · 4.2%
Pre-auth RCE
1
With a fix record
0%
Median publish → KEV
No record has entered KEV

Records by year

  1. 17
  2. 20
  3. 23
  4. 24
  5. 26

Bar: total · dark part: CISA KEV.

Recurring classes

The weakness classes this vendor ships most often: where to look.

CWE

Attack profile

All records

24 records
  • CVE-2017-8835
    60This week

    SQL injection exists on Peplink Balance 305, 380, 580, 710, 1350, and 2500 devices with firmware before fw-b305hw2_380hw6_580hw2_710hw3_1350

    CriticalCVSS 9.8WeaponizedEPSS 61%

    peplink · b305hw2 firmwareJun 5, 2017

  • CVE-2017-8837
    40Plan

    Cleartext password storage exists on Peplink Balance 305, 380, 580, 710, 1350, and 2500 devices with firmware before fw-b305hw2_380hw6_580hw

    CriticalCVSS 9.8Proof of conceptEPSS 4%

    peplink · b305hw2 firmwareJun 5, 2017

  • CVE-2023-39367
    39Monitor

    An OS command injection vulnerability exists in the web interface mac2name functionality of Peplink Smart Reader v1.2.0 (in QEMU).

    HighCVSS 7.2No exploitEPSS 37%

    peplink · smart reader firmwareApr 17, 2024

  • CVE-2023-40146
    39Monitor

    A privilege escalation vulnerability exists in the /bin/login functionality of Peplink Smart Reader v1.2.0 (in QEMU).

    CriticalCVSS 9.8No exploitEPSS 1%

    peplink · smart reader firmwareApr 17, 2024

  • CVE-2023-28381
    37Monitor

    An OS command injection vulnerability exists in the admin.cgi MVPN_trial_init functionality of peplink Surf SOHO HW1 v6.3.5 (in QEMU).

    HighCVSS 8.8No exploitEPSS 6%

    peplink · surf soho firmwareOct 11, 2023

  • CVE-2023-27380
    37Monitor

    An OS command injection vulnerability exists in the admin.cgi USSD_send functionality of peplink Surf SOHO HW1 v6.3.5 (in QEMU).

    HighCVSS 8.8No exploitEPSS 5%

    peplink · surf soho firmwareOct 11, 2023

  • CVE-2023-35193
    37Monitor

    An OS command injection vulnerability exists in the api.cgi cmd.mvpn.x509.write functionality of peplink Surf SOHO HW1 v6.3.5 (in QEMU).

    HighCVSS 8.8No exploitEPSS 5%

    peplink · surf soho firmwareOct 11, 2023

  • CVE-2023-35194
    37Monitor

    An OS command injection vulnerability exists in the api.cgi cmd.mvpn.x509.write functionality of peplink Surf SOHO HW1 v6.3.5 (in QEMU).

    HighCVSS 8.8No exploitEPSS 5%

    peplink · surf soho firmwareOct 11, 2023

  • CVE-2023-34356
    37Monitor

    An OS command injection vulnerability exists in the data.cgi xfer_dns functionality of peplink Surf SOHO HW1 v6.3.5 (in QEMU).

    HighCVSS 8.8No exploitEPSS 5%

    peplink · surf soho firmwareOct 11, 2023

  • CVE-2023-49230
    36Monitor

    An issue was discovered in Peplink Balance Two before 8.4.0.

    HighCVSS 8.8Proof of conceptEPSS 2%

    peplink · balance two firmwareDec 28, 2023

  • CVE-2017-8836
    36Monitor

    CSRF exists on Peplink Balance 305, 380, 580, 710, 1350, and 2500 devices with firmware before fw-b305hw2_380hw6_580hw2_710hw3_1350hw2_2500-

    HighCVSS 8.8Proof of conceptEPSS 1%

    peplink · b305hw2 firmwareJun 5, 2017

  • CVE-2023-45744
    35Monitor

    A data integrity vulnerability exists in the web interface /cgi-bin/upload_config.cgi functionality of Peplink Smart Reader v1.2.0 (in QEMU)

    HighCVSS 8.8No exploitEPSS 1%

    peplink · smart reader firmwareApr 17, 2024

  • CVE-2017-8841
    33Monitor

    Arbitrary file deletion exists on Peplink Balance 305, 380, 580, 710, 1350, and 2500 devices with firmware before fw-b305hw2_380hw6_580hw2_7

    HighCVSS 8.1Proof of conceptEPSS 3%

    peplink · b305hw2 firmwareJun 5, 2017

  • CVE-2023-43491
    30Monitor

    An information disclosure vulnerability exists in the web interface /cgi-bin/debug_dump.cgi functionality of Peplink Smart Reader v1.2.0 (in

    HighCVSS 7.5No exploitEPSS 1%

    peplink · smart reader firmwareApr 17, 2024

  • CVE-2023-45209
    30Monitor

    An information disclosure vulnerability exists in the web interface /cgi-bin/download_config.cgi functionality of Peplink Smart Reader v1.2.

    HighCVSS 7.5No exploitEPSS 1%

    peplink · smart reader firmwareApr 17, 2024

  • CVE-2020-24246
    30Monitor

    Peplink Balance before 8.1.0rc1 allows an unauthenticated attacker to download PHP configuration files (/filemanager/php/connector.php) from

    HighCVSS 7.5No exploitEPSS 1%

    peplink · balance 20x firmwareOct 7, 2020

  • CVE-2026-57920
    30Monitor

    Peplink InControl 2 through 2.14.2 before 2026-06-03 allows use of a semicolon to bypass access-control rules for certain /rest/o/{orgId} en

    HighCVSS 7.7No exploitEPSS 0%

    peplink · intcontrol 2Jun 26, 2026

  • CVE-2023-49226
    29Monitor

    An issue was discovered in Peplink Balance Two before 8.4.0.

    HighCVSS 7.2No exploitEPSS 3%

    peplink · balance two firmwareDec 25, 2023

  • CVE-2017-8838
    25Monitor

    XSS via syncid exists on Peplink Balance 305, 380, 580, 710, 1350, and 2500 devices with firmware before fw-b305hw2_380hw6_580hw2_710hw3_135

    MediumCVSS 6.1Proof of conceptEPSS 1%

    peplink · b305hw2 firmwareJun 5, 2017

  • CVE-2017-8839
    25Monitor

    XSS via orig_url exists on Peplink Balance 305, 380, 580, 710, 1350, and 2500 devices with firmware before fw-b305hw2_380hw6_580hw2_710hw3_1

    MediumCVSS 6.1Proof of conceptEPSS 1%

    peplink · b305hw2 firmwareJun 5, 2017

  • CVE-2023-49228
    25Monitor

    An issue was discovered in Peplink Balance Two before 8.4.0.

    MediumCVSS 6.4No exploitEPSS 0%

    peplink · balance two firmwareDec 28, 2023

  • CVE-2017-8840
    22Monitor

    Debug information disclosure exists on Peplink Balance 305, 380, 580, 710, 1350, and 2500 devices with firmware before fw-b305hw2_380hw6_580

    MediumCVSS 5.3Proof of conceptEPSS 3%

    peplink · b305hw2 firmwareJun 5, 2017

  • CVE-2023-34354
    21Monitor

    A stored cross-site scripting (XSS) vulnerability exists in the upload_brand.cgi functionality of peplink Surf SOHO HW1 v6.3.5 (in QEMU).

    MediumCVSS 5.4No exploitEPSS 0%

    peplink · surf soho firmwareOct 11, 2023

  • CVE-2023-49229
    17Monitor

    An issue was discovered in Peplink Balance Two before 8.4.0.

    MediumCVSS 4.3No exploitEPSS 0%

    peplink · balance two firmwareDec 28, 2023