Peplink Balance Two Firmware vulnerabilities

CVE-2023-49230 [HIGH] CWE-862 CVE-2023-49230: An issue was discovered in Peplink Balance Two before 8.4.0. A missing authorization check in captiv An issue was discovered in Peplink Balance Two before 8.4.0. A missing authorization check in captive portals allows attackers to modify the portals' configurations without prior authentication.

CVE-2023-49226 [HIGH] CWE-77 CVE-2023-49226: An issue was discovered in Peplink Balance Two before 8.4.0. Command injection in the traceroute fea An issue was discovered in Peplink Balance Two before 8.4.0. Command injection in the traceroute feature of the administration console allows users with admin privileges to execute arbitrary commands as root.

CVE-2020-24246 [HIGH] CVE-2020-24246: Peplink Balance before 8.1.0rc1 allows an unauthenticated attacker to download PHP configuration fil Peplink Balance before 8.1.0rc1 allows an unauthenticated attacker to download PHP configuration files (/filemanager/php/connector.php) from Web Admin.

CVE-2023-49228 [MEDIUM] CWE-798 CVE-2023-49228: An issue was discovered in Peplink Balance Two before 8.4.0. Console port authentication uses hard-c An issue was discovered in Peplink Balance Two before 8.4.0. Console port authentication uses hard-coded credentials, which allows an attacker with physical access and sufficient knowledge to execute arbitrary commands as root.

CVE-2023-49229 [MEDIUM] CWE-862 CVE-2023-49229: An issue was discovered in Peplink Balance Two before 8.4.0. A missing authorization check in the ad An issue was discovered in Peplink Balance Two before 8.4.0. A missing authorization check in the administration web service allows read-only, unprivileged users to obtain sensitive information about the device configuration.