high7.5
CVE-2020-24246
Peplink Balance before 8.1.0rc1 allows an unauthenticated attacker to download PHP configuration files (/filemanager/php/connector.php) from Web Admin.
Impact
Peplink Balance before 8.1.0rc1 allows an unauthenticated attacker to download PHP configuration files (/filemanager/php/connector.php) from Web Admin.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Peplink | Balance 20x Firmware | through 8.1.0 |
| Peplink | Balance 310x Firmware | through 8.1.0 |
| Peplink | Mbx Firmware | through 8.1.0 |
| Peplink | Epx Firmware | through 8.1.0 |
| Peplink | Sdx Firmware | through 8.1.0 |
| Peplink | Balance 30 Lte Firmware | through 8.1.0 |
| Peplink | Balance 20 Firmware | through 8.1.0 |
| Peplink | Balance 30 Firmware | through 8.1.0 |
| Peplink | Balance 30 Pro Firmware | through 8.1.0 |
| Peplink | Balance 50 Firmware | through 8.1.0 |
| Peplink | Balance One Firmware | through 8.1.0 |
| Peplink | Balance Two Firmware | through 8.1.0 |
References
- NVD record
- CVE.org record
- https://blog.bssi.fr/cve-2020-24246-leaking-source-file-using-the-web-admin-interface-of-peplink-balance/
- https://download.peplink.com/resources/firmware-8.1.0rc1-release-notes.pdf
- https://blog.bssi.fr/cve-2020-24246-leaking-source-file-using-the-web-admin-interface-of-peplink-balance/
- https://download.peplink.com/resources/firmware-8.1.0rc1-release-notes.pdf