CVE-2017-8840

Published: Jun 5, 2017Modified: May 13, 2026

5.3

Vector

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Exploitability: 3.9 / Impact: 1.4

Source: NVD

Description

Debug information disclosure exists on Peplink Balance 305, 380, 580, 710, 1350, and 2500 devices with firmware before fw-b305hw2_380hw6_580hw2_710hw3_1350hw2_2500-7.0.1-build2093. A direct request to cgi-bin/HASync/hasync.cgi?debug=1 shows Master LAN Address, Serial Number, HA Group ID, Virtual IP, and Submitted syncid.

Affected (6)

Products: Peplink: B305hw2 Firmware, 380hw6 Firmware, 580hw2 Firmware, 710hw3 Firmware, 1350hw2 Firmware, 2500 Firmware

6 products

Configuration A

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Peplink B305hw2 Firmware	Version 7.0.1

Running on/with	Platform Versions
Peplink Balance 305	All versions

Configuration B

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Peplink 380hw6 Firmware	Version 7.0.1

Running on/with	Platform Versions
Peplink Balance 380	All versions

Configuration C

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Peplink 580hw2 Firmware	Version 7.0.1

Running on/with	Platform Versions
Peplink Balance 580	All versions

Configuration D

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Peplink 710hw3 Firmware	Version 7.0.1

Running on/with	Platform Versions
Peplink Balance 710	All versions

Configuration E

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Peplink 1350hw2 Firmware	Version 7.0.1

Running on/with	Platform Versions
Peplink Balance 1350	All versions

Configuration F

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Peplink 2500 Firmware	Version 7.0.1

Running on/with	Platform Versions
Peplink Balance 2500	All versions

Related CWEs

CWE-200

Exposure of Sensitive Information to an Unauthorized Actor

The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.

References (6)

http://seclists.org/bugtraq/2017/Jun/1

Source: cve@mitre.org

Mailing ListThird Party Advisory

https://www.exploit-db.com/exploits/42130/

Source: cve@mitre.org

https://www.x41-dsec.de/lab/advisories/x41-2017-005-peplink/

Source: cve@mitre.org

PatchThird Party Advisory

http://seclists.org/bugtraq/2017/Jun/1

Source: af854a3a-2127-422b-91ae-364da2661108

Mailing ListThird Party Advisory

https://www.exploit-db.com/exploits/42130/

Source: af854a3a-2127-422b-91ae-364da2661108

https://www.x41-dsec.de/lab/advisories/x41-2017-005-peplink/

Source: af854a3a-2127-422b-91ae-364da2661108

PatchThird Party Advisory

Timeline

No history available yet.