CVE-2020-24246 : Peplink Balance before 8.1.0rc1 allows an unauthenticated attacker to download P

Peplink Balance before 8.1.0rc1 allows an unauthenticated attacker to download PHP configuration files (/filemanager/php/connector.php) from Web Admin.

Published 2020-10-07 16:15:17

Updated 2020-10-23 02:22:39

Source MITRE

View at NVD, CVE.org

Products affected by CVE-2020-24246

Peplink » Balance 20x Firmware
Versions up to, including, (<=) 8.1.0
cpe:2.3:o:peplink:balance_20x_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Peplink » Balance 20x » Version: N/A
Peplink » Balance 310x Firmware
Versions up to, including, (<=) 8.1.0
cpe:2.3:o:peplink:balance_310x_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Peplink » Balance 310x » Version: N/A
Peplink » Mbx Firmware
Versions up to, including, (<=) 8.1.0
cpe:2.3:o:peplink:mbx_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Peplink » MBX » Version: N/A
Peplink » Epx Firmware
Versions up to, including, (<=) 8.1.0
cpe:2.3:o:peplink:epx_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Peplink » EPX » Version: N/A
Peplink » Sdx Firmware
Versions up to, including, (<=) 8.1.0
cpe:2.3:o:peplink:sdx_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Peplink » SDX » Version: N/A
Peplink » Balance 30 Lte Firmware
Versions up to, including, (<=) 8.1.0
cpe:2.3:o:peplink:balance_30_lte_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Peplink » Balance 30 Lte » Version: N/A
Peplink » Balance 20 Firmware
Versions up to, including, (<=) 8.1.0
cpe:2.3:o:peplink:balance_20_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Peplink » Balance 20 » Version: N/A
Peplink » Balance 30 Firmware
Versions up to, including, (<=) 8.1.0
cpe:2.3:o:peplink:balance_30_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Peplink » Balance 30 » Version: N/A
Peplink » Balance 30 Pro Firmware
Versions up to, including, (<=) 8.1.0
cpe:2.3:o:peplink:balance_30_pro_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Peplink » Balance 30 Pro » Version: N/A
Peplink » Balance 50 Firmware
Versions up to, including, (<=) 8.1.0
cpe:2.3:o:peplink:balance_50_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Peplink » Balance 50 » Version: N/A
Peplink » Balance One Firmware
Versions up to, including, (<=) 8.1.0
cpe:2.3:o:peplink:balance_one_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Peplink » Balance One » Version: N/A
Peplink » Balance Two Firmware
Versions up to, including, (<=) 8.1.0
cpe:2.3:o:peplink:balance_two_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Peplink » Balance Two » Version: N/A
Peplink » Balance 210 Firmware
Versions up to, including, (<=) 8.1.0
cpe:2.3:o:peplink:balance_210_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Peplink » Balance 210 » Version: N/A
Peplink » Balance 310 Firmware
Versions up to, including, (<=) 8.1.0
cpe:2.3:o:peplink:balance_310_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Peplink » Balance 310 » Version: N/A
Peplink » Balance 305 Firmware
Versions up to, including, (<=) 8.1.0
cpe:2.3:o:peplink:balance_305_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Peplink » Balance 305 » Version: HW2
Peplink » Balance 380 Firmware
Versions up to, including, (<=) 8.1.0
cpe:2.3:o:peplink:balance_380_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Peplink » Balance 380 » Version: HW6
Peplink » Balance 580 Firmware
Versions up to, including, (<=) 8.1.0
cpe:2.3:o:peplink:balance_580_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Peplink » Balance 580 » Version: Hw2-3
Peplink » Balance 710 Firmware
Versions up to, including, (<=) 8.1.0
cpe:2.3:o:peplink:balance_710_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Peplink » Balance 710 » Version: HW3
Peplink » Balance 1350 Firmware
Versions up to, including, (<=) 8.1.0
cpe:2.3:o:peplink:balance_1350_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Peplink » Balance 1350 » Version: HW2
Peplink » Balance 2500 Firmware
Versions up to, including, (<=) 8.1.0
cpe:2.3:o:peplink:balance_2500_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Peplink » Balance 2500 » Version: N/A
Peplink » Max Br1 Mk2 Firmware
Versions up to, including, (<=) 8.1.0
cpe:2.3:o:peplink:max_br1_mk2_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Peplink » Max Br1 Mk2 » Version: N/A
Peplink » Max Br1 Classic Firmware
Versions up to, including, (<=) 8.1.0
cpe:2.3:o:peplink:max_br1_classic_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Peplink » Max Br1 Classic » Version: Hw2-3
Peplink » Max Br1 Slim Firmware
Versions up to, including, (<=) 8.1.0
cpe:2.3:o:peplink:max_br1_slim_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Peplink » Max Br1 Slim » Version: N/A
Peplink » Max Br1 Mini Firmware
Versions up to, including, (<=) 8.1.0
cpe:2.3:o:peplink:max_br1_mini_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Peplink » Max Br1 Mini » Version: N/A
Peplink » Max Br1 M2m Firmware
Versions up to, including, (<=) 8.1.0
cpe:2.3:o:peplink:max_br1_m2m_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Peplink » Max Br1 M2m » Version: N/A
Peplink » Max Br1 Ent Firmware
Versions up to, including, (<=) 8.1.0
cpe:2.3:o:peplink:max_br1_ent_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Peplink » Max Br1 Ent » Version: N/A
Peplink » Max Br1 Pro Firmware
Versions up to, including, (<=) 8.1.0
cpe:2.3:o:peplink:max_br1_pro_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Peplink » Max Br1 Pro » Version: N/A
Peplink » Max Br1 Ip67 Firmware
Versions up to, including, (<=) 8.1.0
cpe:2.3:o:peplink:max_br1__ip67_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Peplink » Max Br1 Ip67 » Version: N/A
Peplink » Max Br2 Firmware
Versions up to, including, (<=) 8.1.0
cpe:2.3:o:peplink:max_br2_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Peplink » Max Br2 » Version: N/A
Peplink » Max Br1 Ip55 Firmware
Versions up to, including, (<=) 8.1.0
cpe:2.3:o:peplink:max_br1_ip55_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Peplink » Max Br1 Ip55 » Version: Hw2-4
Peplink » Max Br2 Ip55 Firmware
Versions up to, including, (<=) 8.1.0
cpe:2.3:o:peplink:max_br2_ip55_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Peplink » Max Br2 Ip55 » Version: Hw2-3
Peplink » Max Hd2 Ip67 Firmware
Versions up to, including, (<=) 8.1.0
cpe:2.3:o:peplink:max_hd2_ip67_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Peplink » Max Hd2 Ip67 » Version: N/A
Peplink » Max Hd2 Mini Firmware
Versions up to, including, (<=) 8.1.0
cpe:2.3:o:peplink:max_hd2_mini_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Peplink » Max Hd2 Mini » Version: N/A
Peplink » Max Hd2 Firmware
Versions up to, including, (<=) 8.1.0
cpe:2.3:o:peplink:max_hd2_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Peplink » Max Hd2 » Version: N/A
Peplink » Max Hd1 Dome Firmware
Versions up to, including, (<=) 8.1.0
cpe:2.3:o:peplink:max_hd1_dome_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Peplink » Max Hd1 Dome » Version: N/A
Peplink » Max Hd2 Dome Firmware
Versions up to, including, (<=) 8.1.0
cpe:2.3:o:peplink:max_hd2_dome_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Peplink » Max Hd2 Dome » Version: N/A
Peplink » Max Hd4 Firmware
Versions up to, including, (<=) 8.1.0
cpe:2.3:o:peplink:max_hd4_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Peplink » Max Hd4 » Version: N/A
Peplink » Max Hd4 Ip67 Firmware
Versions up to, including, (<=) 8.1.0
cpe:2.3:o:peplink:max_hd4_ip67_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Peplink » Max Hd4 Ip67 » Version: N/A
Peplink » Max Transit Firmware
Versions up to, including, (<=) 8.1.0
cpe:2.3:o:peplink:max_transit_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Peplink » Max Transit » Version: N/A
Peplink » Max Transit Duo Firmware
Versions up to, including, (<=) 8.1.0
cpe:2.3:o:peplink:max_transit_duo_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Peplink » Max Transit Duo » Version: N/A
Peplink » Max Transit Mini Firmware
Versions up to, including, (<=) 8.1.0
cpe:2.3:o:peplink:max_transit_mini_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Peplink » Max Transit Mini » Version: N/A
Peplink » Max Hotspot Firmware
Versions up to, including, (<=) 8.1.0
cpe:2.3:o:peplink:max_hotspot_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Peplink » Max Hotspot » Version: N/A
Peplink » Max On-the-go Firmware
Versions up to, including, (<=) 8.1.0
cpe:2.3:o:peplink:max_on-the-go_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Peplink » Max On-the-go » Version: HW2
Peplink » Max 700 Firmware
Versions up to, including, (<=) 8.1.0
cpe:2.3:o:peplink:max_700_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Peplink » Max 700 » Version: N/A
Peplink » Ubr Lte Firmware
Versions up to, including, (<=) 8.1.0
cpe:2.3:o:peplink:ubr_lte_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Peplink » Ubr Lte » Version: N/A
Peplink » Surf Soho Firmware
Versions up to, including, (<=) 8.1.0
cpe:2.3:o:peplink:surf_soho_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Peplink » Surf Soho » Version: HW2
Peplink » Surf Soho Mk3 Firmware
Versions up to, including, (<=) 8.1.0
cpe:2.3:o:peplink:surf_soho_mk3_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Peplink » Surf Soho Mk3 » Version: N/A
Peplink » Mediafast 200 Firmware
Versions up to, including, (<=) 8.1.0
cpe:2.3:o:peplink:mediafast_200_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Peplink » Mediafast 200 » Version: N/A
Peplink » Mediafast 500 Firmware
Versions up to, including, (<=) 8.1.0
cpe:2.3:o:peplink:mediafast_500_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Peplink » Mediafast 500 » Version: N/A
Peplink » Mediafast 750 Firmware
Versions up to, including, (<=) 8.1.0
cpe:2.3:o:peplink:mediafast_750_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Peplink » Mediafast 750 » Version: N/A
Peplink » Mediafast Hd2 Firmware
Versions up to, including, (<=) 8.1.0
cpe:2.3:o:peplink:mediafast_hd2_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Peplink » Mediafast Hd2 » Version: N/A
Peplink » Mediafast Hd4 Firmware
Versions up to, including, (<=) 8.1.0
cpe:2.3:o:peplink:mediafast_hd4_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Peplink » Mediafast Hd4 » Version: N/A
Peplink » Speedfusion Sfe Firmware
Versions up to, including, (<=) 8.1.0
cpe:2.3:o:peplink:speedfusion_sfe_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Peplink » Speedfusion Sfe » Version: N/A
Peplink » Speedfusion Sfe Cam Firmware
Versions up to, including, (<=) 8.1.0
cpe:2.3:o:peplink:speedfusion_sfe_cam_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Peplink » Speedfusion Sfe Cam » Version: N/A
Peplink » Fusionhub Firmware
Versions up to, including, (<=) 8.1.0
cpe:2.3:o:peplink:fusionhub_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Peplink » Fusionhub » Version: N/A

Exploit prediction scoring system (EPSS) score for CVE-2020-24246

EPSS FAQ

0.26%

Probability of exploitation activity in the next 30 days EPSS Score History

~ 66 %

Percentile, the proportion of vulnerabilities that are scored at or less

CVSS scores for CVE-2020-24246

Base Score	Base Severity	CVSS Vector	Exploitability Score	Impact Score	Score Source
5.0	MEDIUM	AV:N/AC:L/Au:N/C:P/I:N/A:N	10.0	2.9	NIST
Access Vector: Network Access Complexity: Low Authentication: None Confidentiality Impact: Partial Integrity Impact: None Availability Impact: None
7.5	HIGH	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N	3.9	3.6	NIST
Attack Vector: Network Attack Complexity: Low Privileges Required: None User Interaction: None Scope: Unchanged Confidentiality: High Integrity: None Availability: None

References for CVE-2020-24246

https://blog.bssi.fr/cve-2020-24246-leaking-source-file-using-the-web-admin-interface-of-peplink-balance/

[CVE-2020-24246] Leaking source file using the web admin interface of Peplink Balance - Blog BSSI
Exploit;Third Party Advisory
https://download.peplink.com/resources/firmware-8.1.0rc1-release-notes.pdf

Release Notes;Vendor Advisory

Jump to

Vulnerability Details : CVE-2020-24246

Products affected by CVE-2020-24246

Exploit prediction scoring system (EPSS) score for CVE-2020-24246

CVSS scores for CVE-2020-24246

References for CVE-2020-24246