CyberSec.Space Logo
Back to CVE Browser

CVE-2017-8838

MEDIUM
6.1
CVSS Severity Score
EPSS Score0.1420%
EPSS Percentile33.36th
PublishedJun 5, 2017
Last ModifiedMay 13, 2026

Vulnerability Description

XSS via syncid exists on Peplink Balance 305, 380, 580, 710, 1350, and 2500 devices with firmware before fw-b305hw2_380hw6_580hw2_710hw3_1350hw2_2500-7.0.1-build2093. The affected script is cgi-bin/HASync/hasync.cgi.

Affected Platforms (CPE)

💻
Peplink

B305hw2 Firmware

= 7.0.1
💻
Peplink

380hw6 Firmware

= 7.0.1
💻
Peplink

580hw2 Firmware

= 7.0.1
💻
Peplink

710hw3 Firmware

= 7.0.1
💻
Peplink

1350hw2 Firmware

= 7.0.1
💻
Peplink

2500 Firmware

= 7.0.1

References & Advisories

🔗 http://seclists.org/bugtraq/2017/Jun/1
🔗 https://www.exploit-db.com/exploits/42130/
🔗 https://www.x41-dsec.de/lab/advisories/x41-2017-005-peplink/
🔗 http://seclists.org/bugtraq/2017/Jun/1
🔗 https://www.exploit-db.com/exploits/42130/
🔗 https://www.x41-dsec.de/lab/advisories/x41-2017-005-peplink/

Related Vulnerabilities

CVE-2017-88359.8

SQL injection exists on Peplink Balance 305, 380, 580, 710, 1350, and 2500 devices with firmware before fw-b305hw2_380hw6_580hw2_7...

CVE-2017-88379.8

Cleartext password storage exists on Peplink Balance 305, 380, 580, 710, 1350, and 2500 devices with firmware before fw-b305hw2_38...

CVE-2017-88368.8

CSRF exists on Peplink Balance 305, 380, 580, 710, 1350, and 2500 devices with firmware before fw-b305hw2_380hw6_580hw2_710hw3_135...

CVE-2017-88418.1

Arbitrary file deletion exists on Peplink Balance 305, 380, 580, 710, 1350, and 2500 devices with firmware before fw-b305hw2_380hw...

CVE-2017-8838 Detail & Impact Analysis | CVSS 6.1 (MEDIUM) | Cyber-Sec.Space | Cyber-Sec.Space