GCVE - cpe:2.3:o:peplink:balance_two_firmware:*:*:*:*:*:*:*:*

Approved changes feed: RSS · Atom

cpe:2.3:o:peplink:balance_two_firmware:*:*:*:*:*:*:*:*

part: o version: * update: *

Vendor	Peplink (`7fd66203-db7b-5fc4-b96c-b7b360912c0b`)
Product	Balance Two Firmware (`d64ce7d9-5261-5ee3-b1f7-64a480c075d3`)
Edition	*
Language	*
Software edition	*
Target software	*
Target hardware	*
Other	*
Notes	Imported from gcve-enriched-dumps CVE data

PURL mappings

PURL	Source	Last updated
No PURL mappings for this CPE yet.

Vulnerability references

Identifier	cpeApplicability	Submitted	db.gcve.eu details	Rationale
`CVE:CVE-2023-49230`	vulnerable	2026-06-08 06:14:28.843697	Details available An issue was discovered in Peplink Balance Two before 8.4.0. A missing authorization check in captive portals allows attackers to modify the portals' configurations without prior authentication. Published: 2023-12-28T00:00:00.000Z Updated: 2024-08-02T21:53:44.631Z Open on db.gcve.eu Reference links https://www.synacktiv.com/publications%253Ffield_tags_target_id%253D4 https://www.synacktiv.com/sites/default/files/2023-12/synacktiv-peplink-multiple-vulnerabilities.pdf	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2023-49229`	vulnerable	2026-06-08 06:14:28.843397	Details available An issue was discovered in Peplink Balance Two before 8.4.0. A missing authorization check in the administration web service allows read-only, unprivileged users to obtain sensitive information about the device configuration. Published: 2023-12-28T00:00:00.000Z Updated: 2024-08-02T21:53:44.725Z Open on db.gcve.eu Reference links https://www.synacktiv.com/publications%253Ffield_tags_target_id%253D4 https://www.synacktiv.com/sites/default/files/2023-12/synacktiv-peplink-multiple-vulnerabilities.pdf	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2023-49228`	vulnerable	2026-06-08 06:14:28.842812	Details available An issue was discovered in Peplink Balance Two before 8.4.0. Console port authentication uses hard-coded credentials, which allows an attacker with physical access and sufficient knowledge to execute arbitrary commands as root. Published: 2023-12-28T00:00:00.000Z Updated: 2024-11-26T14:49:47.643Z Open on db.gcve.eu Reference links https://www.synacktiv.com/publications%253Ffield_tags_target_id%253D4 https://www.synacktiv.com/sites/default/files/2023-12/synacktiv-peplink-multiple-vulnerabilities.pdf	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2023-49226`	vulnerable	2026-06-08 06:14:28.840981	Details available An issue was discovered in Peplink Balance Two before 8.4.0. Command injection in the traceroute feature of the administration console allows users with admin privileges to execute arbitrary commands as root. Published: 2023-12-25T00:00:00.000Z Updated: 2024-08-02T21:53:45.624Z Open on db.gcve.eu Reference links https://www.synacktiv.com/publications%253Ffield_tags_target_id%253D4 https://www.synacktiv.com/sites/default/files/2023-12/synacktiv-peplink-multiple-vulnerabilities.pdf	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2020-24246`	vulnerable	2026-06-08 05:22:32.676604	Details available Peplink Balance before 8.1.0rc1 allows an unauthenticated attacker to download PHP configuration files (/filemanager/php/connector.php) from Web Admin. Published: 2020-10-07T15:10:19.000Z Updated: 2024-08-04T15:12:08.683Z Open on db.gcve.eu Reference links https://download.peplink.com/resources/firmware-8.1.0rc1-release-notes.pdf https://blog.bssi.fr/cve-2020-24246-leaking-source-file-using-the-web-admin-interface-of-peplink-balance/	Imported from gcve-enriched-dumps CVE data

Contribute

You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.