Skip to content
Signals
NVD · CVE-2026-64604 · In the Linux kernel, the following vulnerability has been resolved: KVM: VMX: Grab vmcs12 on CR8 interception update iff vCPU is in guest mode When updating CR8NVD · CVE-2026-64603 · In the Linux kernel, the following vulnerability has been resolved: platform/x86: intel-hid: Protect ACPI notify handler against recursion Since commit e2ffcda1NVD · CVE-2026-64602 · In the Linux kernel, the following vulnerability has been resolved: iio: adc: spear: Initialize completion before requesting IRQ In the report from Jaeyoung ChuNVD · CVE-2026-64601 · In the Linux kernel, the following vulnerability has been resolved: ALSA: us144mkii: capture_urb_complete: redundant usb_anchor_urb corrupts anchor list on eachCISA KEV · CVE-2026-63077 · 9.8 · JetBrains TeamCity Deserialization of Untrusted Data Vulnerability · Added 2026-08-05 · Due 2026-08-08CISA KEV · CVE-2026-18556 · 7.4 · N-able N-central Authentication Bypass Using an Alternate Path or Channel Vulnerability · Added 2026-08-04 · Due 2026-08-07NVD · CVE-2026-64604 · In the Linux kernel, the following vulnerability has been resolved: KVM: VMX: Grab vmcs12 on CR8 interception update iff vCPU is in guest mode When updating CR8NVD · CVE-2026-64603 · In the Linux kernel, the following vulnerability has been resolved: platform/x86: intel-hid: Protect ACPI notify handler against recursion Since commit e2ffcda1NVD · CVE-2026-64602 · In the Linux kernel, the following vulnerability has been resolved: iio: adc: spear: Initialize completion before requesting IRQ In the report from Jaeyoung ChuNVD · CVE-2026-64601 · In the Linux kernel, the following vulnerability has been resolved: ALSA: us144mkii: capture_urb_complete: redundant usb_anchor_urb corrupts anchor list on eachCISA KEV · CVE-2026-63077 · 9.8 · JetBrains TeamCity Deserialization of Untrusted Data Vulnerability · Added 2026-08-05 · Due 2026-08-08CISA KEV · CVE-2026-18556 · 7.4 · N-able N-central Authentication Bypass Using an Alternate Path or Channel Vulnerability · Added 2026-08-04 · Due 2026-08-07
Dragons Community

Vendors · peplink

peplink

· 1 Critical

Total CVEs

23

Critical

1

Products

118

Search All CVEs →

23

Products (118)

balance 25008 CVEsbalance 13508 CVEsbalance 3808 CVEsbalance 7108 CVEsbalance 5808 CVEsbalance 3058 CVEs1350hw2 firmware7 CVEs710hw3 firmware7 CVEsb305hw2 firmware7 CVEssurf soho7 CVEssurf soho firmware7 CVEs380hw6 firmware7 CVEs580hw2 firmware7 CVEs2500 firmware7 CVEssmart reader firmware5 CVEsbalance two5 CVEssmart reader5 CVEsbalance two firmware5 CVEsbalance 310x1 CVEsbalance 310x firmware1 CVEsbalance 380 firmware1 CVEsbalance 501 CVEsbalance 50 firmware1 CVEsbalance 580 firmware1 CVEsbalance 710 firmware1 CVEsbalance one1 CVEsbalance one firmware1 CVEsepx1 CVEsepx firmware1 CVEsfusionhub1 CVEsfusionhub firmware1 CVEsmax 7001 CVEsmax 700 firmware1 CVEsmax br1 ip671 CVEsmax br1 ip67 firmware1 CVEsmax br1 classic1 CVEsmax br1 classic firmware1 CVEsmax br1 ent1 CVEsmax br1 ent firmware1 CVEsmax br1 ip551 CVEsmax br1 ip55 firmware1 CVEsmax br1 m2m1 CVEsmax br1 m2m firmware1 CVEsmax br1 mini1 CVEsmax br1 mini firmware1 CVEsmax br1 mk21 CVEsmax br1 mk2 firmware1 CVEsmax br1 pro1 CVEsmax br1 pro firmware1 CVEsmax br1 slim1 CVEsmax br1 slim firmware1 CVEsmax br21 CVEsmax br2 firmware1 CVEsmax br2 ip551 CVEsmax br2 ip55 firmware1 CVEsmax hd1 dome1 CVEsmax hd1 dome firmware1 CVEsmax hd21 CVEsmax hd2 dome1 CVEsmax hd2 dome firmware1 CVEsmax hd2 firmware1 CVEsmax hd2 ip671 CVEsmax hd2 ip67 firmware1 CVEsmax hd2 mini1 CVEsmax hd2 mini firmware1 CVEsmax hd41 CVEsmax hd4 firmware1 CVEsmax hd4 ip671 CVEsmax hd4 ip67 firmware1 CVEsmax hotspot1 CVEsmax hotspot firmware1 CVEsmax on-the-go1 CVEsmax on-the-go firmware1 CVEsmax transit1 CVEsmax transit duo1 CVEsmax transit duo firmware1 CVEsmax transit firmware1 CVEsmax transit mini1 CVEsmax transit mini firmware1 CVEsmbx1 CVEsmbx firmware1 CVEsmediafast 2001 CVEsmediafast 200 firmware1 CVEsmediafast 5001 CVEsmediafast 500 firmware1 CVEsmediafast 7501 CVEsmediafast 750 firmware1 CVEsmediafast hd21 CVEsmediafast hd2 firmware1 CVEsmediafast hd41 CVEsmediafast hd4 firmware1 CVEssdx1 CVEssdx firmware1 CVEsspeedfusion sfe1 CVEsspeedfusion sfe cam1 CVEsspeedfusion sfe cam firmware1 CVEsspeedfusion sfe firmware1 CVEssurf soho mk31 CVEssurf soho mk3 firmware1 CVEsubr lte1 CVEsubr lte firmware1 CVEsbalance 1350 firmware1 CVEsbalance 201 CVEsbalance 20 firmware1 CVEsbalance 20x1 CVEsbalance 20x firmware1 CVEsbalance 2101 CVEsbalance 210 firmware1 CVEsbalance 2500 firmware1 CVEsbalance 301 CVEsbalance 305 firmware1 CVEsbalance 30 firmware1 CVEsbalance 30 lte1 CVEsbalance 30 lte firmware1 CVEsbalance 30 pro1 CVEsbalance 30 pro firmware1 CVEsbalance 3101 CVEsbalance 310 firmware1 CVEs

Recent Vulnerabilities

View all 23 →
CVE-2023-45744HIGH 8.3

A data integrity vulnerability exists in the web interface /cgi-bin/upload_config.cgi functionality of Peplink Smart Reader v1.2.0 (in QEMU). A specially crafted HTTP request can lead to configuration modification. An attacker can make an unauthenticated HTTP request to trigger this vulnerability.

CVE-2023-45209MEDIUM 5.3

An information disclosure vulnerability exists in the web interface /cgi-bin/download_config.cgi functionality of Peplink Smart Reader v1.2.0 (in QEMU). A specially crafted HTTP request can lead to a disclosure of sensitive information. An attacker can make an unauthenticated HTTP request to trigger this vulnerability.

CVE-2023-43491MEDIUM 5.3

An information disclosure vulnerability exists in the web interface /cgi-bin/debug_dump.cgi functionality of Peplink Smart Reader v1.2.0 (in QEMU). A specially crafted HTTP request can lead to a disclosure of sensitive information. An attacker can make an unauthenticated HTTP request to trigger this vulnerability.

CVE-2023-40146MEDIUM 6.8

A privilege escalation vulnerability exists in the /bin/login functionality of Peplink Smart Reader v1.2.0 (in QEMU). A specially crafted command line argument can lead to a limited-shell escape and elevated capabilities. An attacker can authenticate with hard-coded credentials and execute unblocked default busybox functionality to trigger this vulnerability.

CVE-2023-39367CRITICAL 9.1

An OS command injection vulnerability exists in the web interface mac2name functionality of Peplink Smart Reader v1.2.0 (in QEMU). A specially crafted HTTP request can lead to arbitrary command execution. An attacker can make an authenticated HTTP request to trigger this vulnerability.

CVE-2023-49230HIGH 8.8

An issue was discovered in Peplink Balance Two before 8.4.0. A missing authorization check in captive portals allows attackers to modify the portals' configurations without prior authentication.

CVE-2023-49229MEDIUM 4.3

An issue was discovered in Peplink Balance Two before 8.4.0. A missing authorization check in the administration web service allows read-only, unprivileged users to obtain sensitive information about the device configuration.

CVE-2023-49228MEDIUM 6.4

An issue was discovered in Peplink Balance Two before 8.4.0. Console port authentication uses hard-coded credentials, which allows an attacker with physical access and sufficient knowledge to execute arbitrary commands as root.

CVE-2023-49226HIGH 7.2

An issue was discovered in Peplink Balance Two before 8.4.0. Command injection in the traceroute feature of the administration console allows users with admin privileges to execute arbitrary commands as root.

CVE-2023-35194HIGH 7.2

An OS command injection vulnerability exists in the api.cgi cmd.mvpn.x509.write functionality of peplink Surf SOHO HW1 v6.3.5 (in QEMU). A specially crafted HTTP request can lead to command execution. An attacker can make an authenticated HTTP request to trigger this vulnerability.This vulnerability is specifically for the `system` call in the file `/web/MANGA/cgi-bin/api.cgi` for firmware version 6.3.5 at offset `0x4bde44`.

CVE-2023-35193HIGH 7.2

An OS command injection vulnerability exists in the api.cgi cmd.mvpn.x509.write functionality of peplink Surf SOHO HW1 v6.3.5 (in QEMU). A specially crafted HTTP request can lead to command execution. An attacker can make an authenticated HTTP request to trigger this vulnerability.This vulnerability is specifically for the `system` call in the file `/web/MANGA/cgi-bin/api.cgi` for firmware version 6.3.5 at offset 0x4bddb8.

CVE-2023-34356HIGH 7.2

An OS command injection vulnerability exists in the data.cgi xfer_dns functionality of peplink Surf SOHO HW1 v6.3.5 (in QEMU). A specially crafted HTTP request can lead to command execution. An attacker can make an authenticated HTTP request to trigger this vulnerability.

CVE-2023-34354LOW 3.4

A stored cross-site scripting (XSS) vulnerability exists in the upload_brand.cgi functionality of peplink Surf SOHO HW1 v6.3.5 (in QEMU). A specially crafted HTTP request can lead to execution of arbitrary javascript in another user's browser. An attacker can make an authenticated HTTP request to trigger this vulnerability.

CVE-2023-28381HIGH 7.2

An OS command injection vulnerability exists in the admin.cgi MVPN_trial_init functionality of peplink Surf SOHO HW1 v6.3.5 (in QEMU). A specially crafted HTTP request can lead to command execution. An attacker can make an authenticated HTTP request to trigger this vulnerability.

CVE-2023-27380HIGH 7.2

An OS command injection vulnerability exists in the admin.cgi USSD_send functionality of peplink Surf SOHO HW1 v6.3.5 (in QEMU). A specially crafted HTTP request can lead to command execution. An attacker can make an authenticated HTTP request to trigger this vulnerability.

CVE-2020-24246HIGH 7.5

Peplink Balance before 8.1.0rc1 allows an unauthenticated attacker to download PHP configuration files (/filemanager/php/connector.php) from Web Admin.

CVE-2017-8841

Arbitrary file deletion exists on Peplink Balance 305, 380, 580, 710, 1350, and 2500 devices with firmware before fw-b305hw2_380hw6_580hw2_710hw3_1350hw2_2500-7.0.1-build2093. The attack methodology is absolute path traversal in cgi-bin/MANGA/firmware_process.cgi via the upfile.path parameter.

CVE-2017-8840

Debug information disclosure exists on Peplink Balance 305, 380, 580, 710, 1350, and 2500 devices with firmware before fw-b305hw2_380hw6_580hw2_710hw3_1350hw2_2500-7.0.1-build2093. A direct request to cgi-bin/HASync/hasync.cgi?debug=1 shows Master LAN Address, Serial Number, HA Group ID, Virtual IP, and Submitted syncid.

CVE-2017-8839

XSS via orig_url exists on Peplink Balance 305, 380, 580, 710, 1350, and 2500 devices with firmware before fw-b305hw2_380hw6_580hw2_710hw3_1350hw2_2500-7.0.1-build2093. The affected script is guest/preview.cgi.

CVE-2017-8838

XSS via syncid exists on Peplink Balance 305, 380, 580, 710, 1350, and 2500 devices with firmware before fw-b305hw2_380hw6_580hw2_710hw3_1350hw2_2500-7.0.1-build2093. The affected script is cgi-bin/HASync/hasync.cgi.

CVE-2017-8837

Cleartext password storage exists on Peplink Balance 305, 380, 580, 710, 1350, and 2500 devices with firmware before fw-b305hw2_380hw6_580hw2_710hw3_1350hw2_2500-7.0.1-build2093. The files in question are /etc/waipass and /etc/roapass. In case one of these devices is compromised, the attacker can gain access to passwords and abuse them to compromise further systems.

CVE-2017-8836

CSRF exists on Peplink Balance 305, 380, 580, 710, 1350, and 2500 devices with firmware before fw-b305hw2_380hw6_580hw2_710hw3_1350hw2_2500-7.0.1-build2093. The CGI scripts in the administrative interface are affected. This allows an attacker to execute commands, if a logged in user visits a malicious website. This can for example be used to change the credentials of the administrative webinterface.

CVE-2017-8835

SQL injection exists on Peplink Balance 305, 380, 580, 710, 1350, and 2500 devices with firmware before fw-b305hw2_380hw6_580hw2_710hw3_1350hw2_2500-7.0.1-build2093. An attack vector is the bauth cookie to cgi-bin/MANGA/admin.cgi. One impact is enumeration of user accounts by observing whether a session ID can be retrieved from the sessions database.