Vulnerability Details CVE-2017-8837
Cleartext password storage exists on Peplink Balance 305, 380, 580, 710, 1350, and 2500 devices with firmware before fw-b305hw2_380hw6_580hw2_710hw3_1350hw2_2500-7.0.1-build2093. The files in question are /etc/waipass and /etc/roapass. In case one of these devices is compromised, the attacker can gain access to passwords and abuse them to compromise further systems.
Exploit prediction scoring system (EPSS) score
EPSS Score 0.11
EPSS Ranking 93.1%
CVSS Severity
CVSS v3 Score 9.8
CVSS v2 Score 5.0
References
Products affected by CVE-2017-8837
-
cpe:2.3:h:peplink:balance_1350:-
-
cpe:2.3:h:peplink:balance_2500:-
-
cpe:2.3:h:peplink:balance_305:-
-
cpe:2.3:h:peplink:balance_380:-
-
cpe:2.3:h:peplink:balance_580:-
-
cpe:2.3:h:peplink:balance_710:-
-
cpe:2.3:o:peplink:1350hw2_firmware:7.0.1
-
cpe:2.3:o:peplink:2500_firmware:7.0.1
-
cpe:2.3:o:peplink:380hw6_firmware:7.0.1
-
cpe:2.3:o:peplink:580hw2_firmware:7.0.1
-
cpe:2.3:o:peplink:710hw3_firmware:7.0.1
-
cpe:2.3:o:peplink:b305hw2_firmware:7.0.1