Console Port Authentication Flaw in Peplink Balance Two
CVE-2023-49228

6.4MEDIUM

Key Information:

Vendor

Peplink

Status
Balance Two
Vendor
CVE Published:
28 December 2023

What is CVE-2023-49228?

A vulnerability exists in the Peplink Balance Two device prior to version 8.4.0, where the console port utilizes hard-coded credentials. This flaw enables an attacker with physical access to the device and adequate knowledge to execute arbitrary commands with root privileges, posing a significant risk to device integrity and security. Remediation is crucial to prevent potential exploitation.

References

https://www.synacktiv.com/publications%253Ffield_tags_tar...
https://www.synacktiv.com/sites/default/files/2023-12/syn...

CVSS V3.1

Score:
6.4
Severity:
MEDIUM
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Physical
Attack Complexity:
High
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.