CVE-2017-8838

Name of the Vulnerable Software and Affected Versions Peplink Balance devices (models 305, 380, 580, 710, 1350, and 2500) with firmware before fw-b305hw2 380hw6 580hw2 710hw3 1350hw2 2500-7.0.1-build2093

Description A cross-site scripting (XSS) issue exists via the syncid parameter. The affected script is located at the "cgi-bin/HASync/hasync.cgi" endpoint.

Recommendations For Peplink Balance devices (models 305, 380, 580, 710, 1350, and 2500) with firmware before fw-b305hw2 380hw6 580hw2 710hw3 1350hw2 2500-7.0.1-build2093, update the firmware to a version after fw-b305hw2 380hw6 580hw2 710hw3 1350hw2 2500-7.0.1-build2093 to resolve the issue. As a temporary workaround, consider restricting access to the "cgi-bin/HASync/hasync.cgi" endpoint until the firmware can be updated.