High severity7.5NVD Advisory· Published Oct 7, 2020· Updated Jun 17, 2026
CVE-2020-24246
CVE-2020-24246
Description
Peplink Balance before 8.1.0rc1 allows an unauthenticated attacker to download PHP configuration files (/filemanager/php/connector.php) from Web Admin.
Affected products
57- cpe:2.3:o:peplink:balance_30_lte_firmware:*:*:*:*:*:*:*:*Range: <=8.1.0
- cpe:2.3:o:peplink:balance_30_pro_firmware:*:*:*:*:*:*:*:*Range: <=8.1.0
- cpe:2.3:o:peplink:max_br1_classic_firmware:*:*:*:*:*:*:*:*Range: <=8.1.0
- cpe:2.3:o:peplink:max_on-the-go_firmware:*:*:*:*:*:*:*:*Range: <=8.1.0
- cpe:2.3:o:peplink:max_transit_duo_firmware:*:*:*:*:*:*:*:*Range: <=8.1.0
- cpe:2.3:o:peplink:max_transit_mini_firmware:*:*:*:*:*:*:*:*Range: <=8.1.0
- cpe:2.3:o:peplink:mediafast_200_firmware:*:*:*:*:*:*:*:*Range: <=8.1.0
- cpe:2.3:o:peplink:mediafast_500_firmware:*:*:*:*:*:*:*:*Range: <=8.1.0
- cpe:2.3:o:peplink:mediafast_750_firmware:*:*:*:*:*:*:*:*Range: <=8.1.0
- cpe:2.3:o:peplink:mediafast_hd2_firmware:*:*:*:*:*:*:*:*Range: <=8.1.0
- cpe:2.3:o:peplink:mediafast_hd4_firmware:*:*:*:*:*:*:*:*Range: <=8.1.0
- cpe:2.3:o:peplink:speedfusion_sfe_cam_firmware:*:*:*:*:*:*:*:*Range: <=8.1.0
- cpe:2.3:o:peplink:speedfusion_sfe_firmware:*:*:*:*:*:*:*:*Range: <=8.1.0
- cpe:2.3:o:peplink:surf_soho_mk3_firmware:*:*:*:*:*:*:*:*Range: <=8.1.0
Patches
Vulnerability mechanics
References
2- blog.bssi.fr/cve-2020-24246-leaking-source-file-using-the-web-admin-interface-of-peplink-balance/nvdExploitThird Party Advisory
- download.peplink.com/resources/firmware-8.1.0rc1-release-notes.pdfnvdRelease NotesVendor Advisory
News mentions
0No linked articles in our index yet.