CVE-2017-8840

Опубликовано: 05 июн. 2017

Источник: nvd

CVSS3: 5.3

CVSS2: 5

EPSS Низкий

Описание

Debug information disclosure exists on Peplink Balance 305, 380, 580, 710, 1350, and 2500 devices with firmware before fw-b305hw2_380hw6_580hw2_710hw3_1350hw2_2500-7.0.1-build2093. A direct request to cgi-bin/HASync/hasync.cgi?debug=1 shows Master LAN Address, Serial Number, HA Group ID, Virtual IP, and Submitted syncid.

Ссылки

http://seclists.org/bugtraq/2017/Jun/1
Mailing List
Third Party Advisory
https://www.exploit-db.com/exploits/42130/
https://www.x41-dsec.de/lab/advisories/x41-2017-005-peplink/
Patch
Third Party Advisory
http://seclists.org/bugtraq/2017/Jun/1
Mailing List
Third Party Advisory
https://www.exploit-db.com/exploits/42130/
https://www.x41-dsec.de/lab/advisories/x41-2017-005-peplink/
Patch
Third Party Advisory

Уязвимые конфигурации

Конфигурация 1

Одновременно

cpe:2.3:o:peplink:b305hw2_firmware:7.0.1:*:*:*:*:*:*:*

cpe:2.3:h:peplink:balance_305:-:*:*:*:*:*:*:*

Конфигурация 2

Одновременно

cpe:2.3:o:peplink:380hw6_firmware:7.0.1:*:*:*:*:*:*:*

cpe:2.3:h:peplink:balance_380:-:*:*:*:*:*:*:*

Конфигурация 3

Одновременно

cpe:2.3:o:peplink:580hw2_firmware:7.0.1:*:*:*:*:*:*:*

cpe:2.3:h:peplink:balance_580:-:*:*:*:*:*:*:*

Конфигурация 4

Одновременно

cpe:2.3:o:peplink:710hw3_firmware:7.0.1:*:*:*:*:*:*:*

cpe:2.3:h:peplink:balance_710:-:*:*:*:*:*:*:*

Конфигурация 5

Одновременно

cpe:2.3:o:peplink:1350hw2_firmware:7.0.1:*:*:*:*:*:*:*

cpe:2.3:h:peplink:balance_1350:-:*:*:*:*:*:*:*

Конфигурация 6

Одновременно

cpe:2.3:o:peplink:2500_firmware:7.0.1:*:*:*:*:*:*:*

cpe:2.3:h:peplink:balance_2500:-:*:*:*:*:*:*:*

EPSS

Процентиль: 88%

0.03845

Низкий

5.3 Medium

CVSS3

5 Medium

CVSS2

Дефекты

CWE-200

Связанные уязвимости

GHSA-5p89-g4ff-g7j6

CVSS3: 5.3

github

больше 3 лет назад

EPSS

Процентиль: 88%

0.03845

Низкий

5.3 Medium

CVSS3

5 Medium

CVSS2

Дефекты

CWE-200