Skip to content
OpenAdvisories
High · 7.2 CVE-2023-34356 EUVD-2023-38436GHSA-p5qp-xrxv-c8wv

An OS command injection vulnerability exists in the data.cgi xfer_dns functionality of peplink Surf SOHO HW1 v6.3.5 (in QEMU). A specially …

Published Oct 11, 2023 · Updated Nov 4, 2025 · Assigned by talos

Vendor: Peplink Product: Surf SOHO HW1

Description

An OS command injection vulnerability exists in the data.cgi xfer_dns functionality of peplink Surf SOHO HW1 v6.3.5 (in QEMU). A specially crafted HTTP request can lead to command execution. An attacker can make an authenticated HTTP request to trigger this vulnerability.

Affected products

VendorProductAffectedFixed
Peplink Surf SOHO HW1 v6.3.5 (in QEMU) —

References