PT-2017-18568
CVE-2017-8838
·
تاريخ النشر
2017-06-05
·
تاريخ التحديث
2017-08-13
الوصف من
CVSS 3.1
6.1
متوسطةالمقاييسAV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Name of the Vulnerable Software and Affected Versions
Peplink Balance devices (models 305, 380, 580, 710, 1350, and 2500) with firmware before fw-b305hw2 380hw6 580hw2 710hw3 1350hw2 2500-7.0.1-build2093
Description
A cross-site scripting (XSS) issue exists via the
syncid parameter. The affected script is located at the "cgi-bin/HASync/hasync.cgi" endpoint.Recommendations
For Peplink Balance devices (models 305, 380, 580, 710, 1350, and 2500) with firmware before fw-b305hw2 380hw6 580hw2 710hw3 1350hw2 2500-7.0.1-build2093, update the firmware to a version after fw-b305hw2 380hw6 580hw2 710hw3 1350hw2 2500-7.0.1-build2093 to resolve the issue. As a temporary workaround, consider restricting access to the "cgi-bin/HASync/hasync.cgi" endpoint until the firmware can be updated.
وجدت خطأً في الوصف؟ لديك ما تضيفه؟ لا تتردد في مراسلتنا 👾