CVE-2023-34354

Name of the Vulnerable Software and Affected Versions peplink Surf SOHO HW1 version 6.3.5

Description A stored cross-site scripting (XSS) issue exists in the upload brand.cgi functionality. This allows an attacker to execute arbitrary javascript in another user's browser by making a specially crafted HTTP request. The request must be authenticated to trigger this issue.

Recommendations For version 6.3.5, consider disabling the upload brand.cgi functionality until a patch is available to prevent exploitation. Restrict access to this functionality to minimize the risk of arbitrary javascript execution in another user's browser.