Peplink
18 CVEs across 122 Peplink products. Browse Peplink vulnerabilities, severities, and proof-of-concept exploits.
Peplink products with known CVEs
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-57920 | High | 7.7 | 2026-06-26 | Peplink InControl 2 through 2.14.2 before 2026-06-03 allows use of a semicolon to bypass access-control rules for certain /rest/o/{orgId} endpoints. |
CVE-2023-45744 | High | 8.3 | 2024-04-17 | A data integrity vulnerability exists in the web interface /cgi-bin/upload_config.cgi functionality of Peplink Smart Reader v1.2.0 (in QEMU). A specially craft… |
CVE-2023-45209 | Medium | 5.3 | 2024-04-17 | An information disclosure vulnerability exists in the web interface /cgi-bin/download_config.cgi functionality of Peplink Smart Reader v1.2.0 (in QEMU). A spec… |
CVE-2023-43491 | Medium | 5.3 | 2024-04-17 | An information disclosure vulnerability exists in the web interface /cgi-bin/debug_dump.cgi functionality of Peplink Smart Reader v1.2.0 (in QEMU). A specially… |
CVE-2023-40146 | Medium | 6.8 | 2024-04-17 | A privilege escalation vulnerability exists in the /bin/login functionality of Peplink Smart Reader v1.2.0 (in QEMU). A specially crafted command line argument… |
CVE-2023-39367 | Critical | 9.1 | 2024-04-17 | An OS command injection vulnerability exists in the web interface mac2name functionality of Peplink Smart Reader v1.2.0 (in QEMU). A specially crafted HTTP req… |
CVE-2023-49230 | High | 8.8 | 2023-12-28 | An issue was discovered in Peplink Balance Two before 8.4.0. A missing authorization check in captive portals allows attackers to modify the portals' configura… |
CVE-2023-49229 | Medium | 4.3 | 2023-12-28 | An issue was discovered in Peplink Balance Two before 8.4.0. A missing authorization check in the administration web service allows read-only, unprivileged use… |
CVE-2023-49228 | Medium | 6.4 | 2023-12-28 | An issue was discovered in Peplink Balance Two before 8.4.0. Console port authentication uses hard-coded credentials, which allows an attacker with physical ac… |
CVE-2023-49226 | High | 7.2 | 2023-12-25 | An issue was discovered in Peplink Balance Two before 8.4.0. Command injection in the traceroute feature of the administration console allows users with admin… |
CVE-2023-35194 | High | 7.2 | 2023-10-11 | An OS command injection vulnerability exists in the api.cgi cmd.mvpn.x509.write functionality of peplink Surf SOHO HW1 v6.3.5 (in QEMU). A specially crafted HT… |
CVE-2023-35193 | High | 7.2 | 2023-10-11 | An OS command injection vulnerability exists in the api.cgi cmd.mvpn.x509.write functionality of peplink Surf SOHO HW1 v6.3.5 (in QEMU). A specially crafted HT… |
CVE-2023-34356 | High | 7.2 | 2023-10-11 | An OS command injection vulnerability exists in the data.cgi xfer_dns functionality of peplink Surf SOHO HW1 v6.3.5 (in QEMU). A specially crafted HTTP request… |
CVE-2023-34354 | Low | 3.4 | 2023-10-11 | A stored cross-site scripting (XSS) vulnerability exists in the upload_brand.cgi functionality of peplink Surf SOHO HW1 v6.3.5 (in QEMU). A specially crafted H… |
CVE-2023-28381 | High | 7.2 | 2023-10-11 | An OS command injection vulnerability exists in the admin.cgi MVPN_trial_init functionality of peplink Surf SOHO HW1 v6.3.5 (in QEMU). A specially crafted HTTP… |
CVE-2023-27380 | High | 7.2 | 2023-10-11 | An OS command injection vulnerability exists in the admin.cgi USSD_send functionality of peplink Surf SOHO HW1 v6.3.5 (in QEMU). A specially crafted HTTP reque… |
CVE-2020-24246 | High | 7.5 | 2020-10-07 | Peplink Balance before 8.1.0rc1 allows an unauthenticated attacker to download PHP configuration files (/filemanager/php/connector.php) from Web Admin. |
CVE-2017-8841 | High | 8.1 | 2017-06-05 | Arbitrary file deletion exists on Peplink Balance 305, 380, 580, 710, 1350, and 2500 devices with firmware before fw-b305hw2_380hw6_580hw2_710hw3_1350hw2_2500-… |
CVE-2017-8840 | Medium | 5.3 | 2017-06-05 | Debug information disclosure exists on Peplink Balance 305, 380, 580, 710, 1350, and 2500 devices with firmware before fw-b305hw2_380hw6_580hw2_710hw3_1350hw2_… |
CVE-2017-8839 | Medium | 6.1 | 2017-06-05 | XSS via orig_url exists on Peplink Balance 305, 380, 580, 710, 1350, and 2500 devices with firmware before fw-b305hw2_380hw6_580hw2_710hw3_1350hw2_2500-7.0.1-b… |
CVE-2017-8838 | Medium | 6.1 | 2017-06-05 | XSS via syncid exists on Peplink Balance 305, 380, 580, 710, 1350, and 2500 devices with firmware before fw-b305hw2_380hw6_580hw2_710hw3_1350hw2_2500-7.0.1-bui… |
CVE-2017-8837 | Critical | 9.8 | 2017-06-05 | Cleartext password storage exists on Peplink Balance 305, 380, 580, 710, 1350, and 2500 devices with firmware before fw-b305hw2_380hw6_580hw2_710hw3_1350hw2_25… |
CVE-2017-8836 | High | 8.8 | 2017-06-05 | CSRF exists on Peplink Balance 305, 380, 580, 710, 1350, and 2500 devices with firmware before fw-b305hw2_380hw6_580hw2_710hw3_1350hw2_2500-7.0.1-build2093. Th… |
CVE-2017-8835 | Critical | 9.8 | 2017-06-05 | SQL injection exists on Peplink Balance 305, 380, 580, 710, 1350, and 2500 devices with firmware before fw-b305hw2_380hw6_580hw2_710hw3_1350hw2_2500-7.0.1-buil… |