Lucene search

[email protected]CVE-2023-49228

HistoryDec 28, 2023 - 4:15 a.m.

CVE-2023-49228

2023-12-2804:15:08

CWE-798

[email protected]

web.nvd.nist.gov

peplink

balance two

cve-2023-49228

security vulnerability

hard-coded credentials

6.4 Medium

CVSS3

Attack Vector

PHYSICAL

Attack Complexity

HIGH

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:P/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

6.8 Medium

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

21.7%

JSON

An issue was discovered in Peplink Balance Two before 8.4.0. Console port authentication uses hard-coded credentials, which allows an attacker with physical access and sufficient knowledge to execute arbitrary commands as root.

Affected configurations

NVD

Node

peplinkbalance_two_firmwareRange<8.4.0

AND

peplinkbalance_twoMatch-

CPENameOperatorVersion
peplink:balance_two_firmwarepeplink balance two firmwarelt8.4.0

CPE	Name	Operator	Version
peplink:balance_two_firmware	peplink balance two firmware	lt	8.4.0

References

www.synacktiv.com/publications%253Ffield_tags_target_id%253D4

www.synacktiv.com/sites/default/files/2023-12/synacktiv-peplink-multiple-vulnerabilities.pdf

6.4 Medium

CVSS3

Attack Vector

PHYSICAL

Attack Complexity

HIGH

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:P/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

6.8 Medium

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

21.7%

JSON

Related for CVE-2023-49228

nvd1 cvelist1 prion1