CVE-2017-8841: Improper Limitation of a Pathname to a Restricted Directory

Arbitrary file deletion exists on Peplink Balance 305, 380, 580, 710, 1350, and 2500 devices with firmware before fw-b305hw2380hw6580hw2710hw31350hw22500-7.0.1-build2093. The attack methodology is absolute path traversal in cgi-bin/MANGA/firmwareprocess.cgi via the upfile.path parameter...

PT-2017-18571

Name of the Vulnerable Software and Affected Versions Peplink Balance devices 305, 380, 580, 710, 1350, and 2500 with firmware before 7.0.1-build2093 Description The issue is related to arbitrary file deletion. It is caused by an absolute path traversal in the "cgi-bin/MANGA/firmware process.cgi"...