CVE-2017-8836

CSRF exists on Peplink Balance 305, 380, 580, 710, 1350, and 2500 devices with firmware before fw-b305hw2_380hw6_580hw2_710hw3_1350hw2_2500-7.0.1-build2093. The CGI scripts in the administrative interface are affected. This allows an attacker to execute commands, if a logged in user visits a malicious website. This can for example be used to change the credentials of the administrative webinterface.

• CWE-352

• http://seclists.org/bugtraq/2017/Jun/1Mailing List, Third Party Advisory
• https://www.exploit-db.com/exploits/42130/
• https://www.x41-dsec.de/lab/advisories/x41-2017-005-peplink/Third Party Advisory
• http://seclists.org/bugtraq/2017/Jun/1Mailing List, Third Party Advisory
• https://www.exploit-db.com/exploits/42130/
• https://www.x41-dsec.de/lab/advisories/x41-2017-005-peplink/Third Party Advisory

Published

Jun 5, 2017

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2017-8830In ImageMagick 7.0.5-6, the ReadBMPImage function in bmp.c:1…
• CVE-2017-8831The saa7164_bus_get function in drivers/media/pci/saa7164/sa…6.4
• CVE-2017-8832Allen Disk 1.6 has XSS in the id parameter to downfile.php.
• CVE-2017-8833Zen Cart 1.6.0 has XSS in the main_page parameter to index.p…
• CVE-2017-8834The cr_tknzr_parse_comment function in cr-tknzr.c in libcroc…6.5
• CVE-2017-8835SQL injection exists on Peplink Balance 305, 380, 580, 710, …
• CVE-2017-8837Cleartext password storage exists on Peplink Balance 305, 38…
• CVE-2017-8838XSS via syncid exists on Peplink Balance 305, 380, 580, 710,…
• CVE-2017-8839XSS via orig_url exists on Peplink Balance 305, 380, 580, 71…
• CVE-2017-8840Debug information disclosure exists on Peplink Balance 305, …
• CVE-2017-8841Arbitrary file deletion exists on Peplink Balance 305, 380, …
• CVE-2017-8842The bufRead::get() function in libzpaq/libzpaq.h in liblrzip…5.5