Balance Two Firmware

balance_two_firmware

Vendor: Peplink • 5 CVEs

CVEs (5)

CVE VENDORS PRODUCTS UPDATED PUBLISHED CVSS
CVE-2023-49230 1Peplink 1Balance Two Firmware Nov 21, 2024 Dec 28, 2023 N/A· v4 8.8 HIGH· v3 N/A· v2 An issue was discovered in Peplink Balance Two before 8.4.0. A missing authorization check in captive portals allows attackers to modify the portals' configurations without prior authentication.
CVE-2023-49229 1Peplink 1Balance Two Firmware Nov 21, 2024 Dec 28, 2023 N/A· v4 4.3 MEDIUM· v3 N/A· v2 An issue was discovered in Peplink Balance Two before 8.4.0. A missing authorization check in the administration web service allows read-only, unprivileged users to obtain sensitive information about the device configura...Show more An issue was discovered in Peplink Balance Two before 8.4.0. A missing authorization check in the administration web service allows read-only, unprivileged users to obtain sensitive information about the device configuration.Show less
CVE-2023-49228 1Peplink 1Balance Two Firmware Nov 21, 2024 Dec 28, 2023 N/A· v4 6.4 MEDIUM· v3 N/A· v2 An issue was discovered in Peplink Balance Two before 8.4.0. Console port authentication uses hard-coded credentials, which allows an attacker with physical access and sufficient knowledge to execute arbitrary commands a...Show more An issue was discovered in Peplink Balance Two before 8.4.0. Console port authentication uses hard-coded credentials, which allows an attacker with physical access and sufficient knowledge to execute arbitrary commands as root.Show less
CVE-2023-49226 1Peplink 1Balance Two Firmware Nov 21, 2024 Dec 25, 2023 N/A· v4 7.2 HIGH· v3 N/A· v2 An issue was discovered in Peplink Balance Two before 8.4.0. Command injection in the traceroute feature of the administration console allows users with admin privileges to execute arbitrary commands as root.
CVE-2020-24246 1Peplink 55Balance 1350 Firmware Balance 20 FirmwareBalance 20x Firmware+52 more Nov 21, 2024 Oct 7, 2020 N/A· v4 7.5 HIGH· v3 5.0 MEDIUM· v2 Peplink Balance before 8.1.0rc1 allows an unauthenticated attacker to download PHP configuration files (/filemanager/php/connector.php) from Web Admin.