Unscored CVE-2020-24246 EUVD-2020-16981GHSA-873q-6mjj-g9m5

Peplink Balance before 8.1.0rc1 allows an unauthenticated attacker to download PHP configuration files (/filemanager/php/connector.php) fro…

Published Oct 7, 2020 · Updated Aug 4, 2024 · Assigned by mitre

Description

Peplink Balance before 8.1.0rc1 allows an unauthenticated attacker to download PHP configuration files (/filemanager/php/connector.php) from Web Admin.

References

https://download.peplink.com/resources/firmware-8.1.0rc1-release-notes.pdf
https://blog.bssi.fr/cve-2020-24246-leaking-source-file-using-the-web-admin-interface-of-peplink-balance/