Skip to content
OpenAdvisories
High · 7.2 CVE-2023-27380 EUVD-2023-31156GHSA-726f-hhr3-x9g3

An OS command injection vulnerability exists in the admin.cgi USSD_send functionality of peplink Surf SOHO HW1 v6.3.5 (in QEMU). A speciall…

Published Oct 11, 2023 · Updated Sep 18, 2024 · Assigned by talos

Vendor: Peplink Product: Surf SOHO HW1

Description

An OS command injection vulnerability exists in the admin.cgi USSD_send functionality of peplink Surf SOHO HW1 v6.3.5 (in QEMU). A specially crafted HTTP request can lead to command execution. An attacker can make an authenticated HTTP request to trigger this vulnerability.

Affected products

VendorProductAffectedFixed
Peplink Surf SOHO HW1 v6.3.5 (in QEMU) —

References