VulnerabilityModified
CVE-2020-24246
Peplink Balance before 8.1.0rc1 allows an unauthenticated attacker to download PHP configuration files (/filemanager/php/connector.php) from Web Admin.
HIGH 7.5EPSS 1.28%
Does this matter?
High impact if exploited, but EPSS currently rates exploitation as unlikely (1.28%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.
Description
Peplink Balance before 8.1.0rc1 allows an unauthenticated attacker to download PHP configuration files (/filemanager/php/connector.php) from Web Admin.
- CVSS 3.1
- 7.5 HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
- EPSS
- 1.28% probability · 68th percentile
- CISA KEV
- Not listed
- Affected
- peplink/balance 20x firmware · peplink/balance 310x firmware · peplink/mbx firmware · peplink/epx firmware · peplink/sdx firmware · peplink/balance 30 lte firmware · peplink/balance 20 firmware · peplink/balance 30 firmware · peplink/balance 30 pro firmware · peplink/balance 50 firmware · peplink/balance one firmware · peplink/balance two firmware · peplink/balance 210 firmware · peplink/balance 310 firmware · peplink/balance 305 firmware · peplink/balance 380 firmware · peplink/balance 580 firmware · peplink/balance 710 firmware · peplink/balance 1350 firmware · peplink/balance 2500 firmware · +35 more
- Source
- cve@mitre.org
References
- https://blog.bssi.fr/cve-2020-24246-leaking-source-file-using-the-web-admin-interface-of-peplink-balance/Exploit, Third Party Advisory
- https://download.peplink.com/resources/firmware-8.1.0rc1-release-notes.pdfRelease Notes, Vendor Advisory
- https://blog.bssi.fr/cve-2020-24246-leaking-source-file-using-the-web-admin-interface-of-peplink-balance/Exploit, Third Party Advisory
- https://download.peplink.com/resources/firmware-8.1.0rc1-release-notes.pdfRelease Notes, Vendor Advisory
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.