PT-2026-52699 · Peplink · Incontrol 2

CVE-2026-57920

·

Published

2026-06-26

·

Updated

2026-07-02

CVSS v3.1

7.7

High

VectorAV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N
Name of the Vulnerable Software and Affected Versions Peplink InControl 2 versions 2 through 2.14.2
Description An access control bypass exists in certain /rest/o/{orgId} endpoints. This issue allows the use of a semicolon to circumvent established access-control rules.
Recommendations Update Peplink InControl 2 to a version released after 2026-06-03.

Exploit

Fix

Found an issue in the description? Have something to add? Feel free to write us 👾
dbugs@ptsecurity.com

Weakness Enumeration

CWE-551

Related Identifiers

CVE-2026-57920

Affected Products

Incontrol 2