Skip to content
OpenAdvisories
High · 7.2 CVE-2023-28381 EUVD-2023-32077GHSA-x6x8-jpgv-4ggp

An OS command injection vulnerability exists in the admin.cgi MVPN_trial_init functionality of peplink Surf SOHO HW1 v6.3.5 (in QEMU). A sp…

Published Oct 11, 2023 · Updated Nov 4, 2025 · Assigned by talos

Vendor: Peplink Product: Surf SOHO HW1

Description

An OS command injection vulnerability exists in the admin.cgi MVPN_trial_init functionality of peplink Surf SOHO HW1 v6.3.5 (in QEMU). A specially crafted HTTP request can lead to command execution. An attacker can make an authenticated HTTP request to trigger this vulnerability.

Affected products

VendorProductAffectedFixed
Peplink Surf SOHO HW1 v6.3.5 (in QEMU) —

References