Predictive Vulnerability Intelligence.

Product

  • Product
  • Pricing
  • Documentation

Company

  • About
  • Partnerships
  • Blog
  • Support

Legal

  • Terms
  • Privacy
  • Data Licensing

© 2026 FAUCET Technologies LLC. All rights reserved.

Peplink

First CVE: Jun 5, 2017Active for: 9 yearsTotal CVEs: 24
48.1
VTI Score
High

Peplink manufactures a line of enterprise and mid-market load-balancing and SD-WAN appliances, prominently the Balance series, that serve as critical routing and traffic-management chokepoints in network infrastructure. Vulnerabilities affecting the vendor skew toward serious outcomes, with an elevated share reaching critical severity, and frequently acquire public exploit code, reflecting the appliances' internet-facing and privileged network role. The exposure recurs across Balance product models through weakness classes centered on command injection, improper access control, and cross-site scripting—flaws that directly threaten command execution, authentication bypass, and management-interface compromise on devices that control network traffic flows. Defenders should prioritize patching these appliances and restrict administrative access; live exploitation and severity counts are shown alongside this summary.

FAUCET AI Generated
24
Total CVEs
More Total CVEs than 97% of tracked vendors
0.0
Avg CVEs / Product / Year
Bottom 1%
7.8
Avg CVSS Score
Higher Avg CVSS Score than 74% of tracked vendors
0.0%
In CISA KEV
Bottom 1%

Trends Over Time

The number and severity of CVEs published that impact products developed by Peplink over time

Volume of CVEsAvg CVSS Base Score
First CVE
Jun 5, 2017
9 years ago
Most Recent CVE
Jun 26, 2026
28 days ago

Products(119 total)

Top CVEs

Signals from CVEs in this vendor scope (24 CVEs).

24 CVEs · Highest risk first

CVEPublishedCVSSRiskKEVExploit
CVE-2017-8835CRITICAL
SQL injection exists on Peplink Balance 305, 380, 580, 710, 1350, and 2500 devices with firmware before fw-b305hw2_380hw6_580hw2_710hw3_1350hw2_2500-7.0.1-build2093. An attack vect
Jun 5, 20179.880NOYES
CVE-2017-8837CRITICAL
Cleartext password storage exists on Peplink Balance 305, 380, 580, 710, 1350, and 2500 devices with firmware before fw-b305hw2_380hw6_580hw2_710hw3_1350hw2_2500-7.0.1-build2093. T
Jun 5, 20179.844NOYES
CVE-2023-39367HIGH
An OS command injection vulnerability exists in the web interface mac2name functionality of Peplink Smart Reader v1.2.0 (in QEMU). A specially crafted HTTP request can lead to arbi
Apr 17, 20247.239NONO
CVE-2017-8841HIGH
Arbitrary file deletion exists on Peplink Balance 305, 380, 580, 710, 1350, and 2500 devices with firmware before fw-b305hw2_380hw6_580hw2_710hw3_1350hw2_2500-7.0.1-build2093. The
Jun 5, 20178.137NOYES
CVE-2017-8836HIGH
CSRF exists on Peplink Balance 305, 380, 580, 710, 1350, and 2500 devices with firmware before fw-b305hw2_380hw6_580hw2_710hw3_1350hw2_2500-7.0.1-build2093. The CGI scripts in the
Jun 5, 20178.837NOYES
CVE-2023-49230HIGH
An issue was discovered in Peplink Balance Two before 8.4.0. A missing authorization check in captive portals allows attackers to modify the portals' configurations without prior a
Dec 28, 20238.836NOYES
CVE-2026-57920HIGH
Peplink InControl 2 through 2.14.2 before 2026-06-03 allows use of a semicolon to bypass access-control rules for certain /rest/o/{orgId} endpoints.
Jun 26, 20267.730NONO
CVE-2017-8840MEDIUM
Debug information disclosure exists on Peplink Balance 305, 380, 580, 710, 1350, and 2500 devices with firmware before fw-b305hw2_380hw6_580hw2_710hw3_1350hw2_2500-7.0.1-build2093.
Jun 5, 20175.330NOYES
CVE-2017-8839MEDIUM
XSS via orig_url exists on Peplink Balance 305, 380, 580, 710, 1350, and 2500 devices with firmware before fw-b305hw2_380hw6_580hw2_710hw3_1350hw2_2500-7.0.1-build2093. The affecte
Jun 5, 20176.130NOYES
CVE-2017-8838MEDIUM
XSS via syncid exists on Peplink Balance 305, 380, 580, 710, 1350, and 2500 devices with firmware before fw-b305hw2_380hw6_580hw2_710hw3_1350hw2_2500-7.0.1-build2093. The affected
Jun 5, 20176.130NOYES
View all 24 CVEs →

CVE Severity & Scoring

Severity distribution of CVEs that affect this vendor's products24 CVEs
25%
63%
13%
Severity distribution among all CVEs352,294 CVEs
45%
40%
11%
MediumHighCritical
Attack Vector
Local0 (0.0%)
Network23 (95.8%)
Unknown0 (0.0%)
Physical1 (4.2%)
Adjacent Network0 (0.0%)
Attack Complexity
Low23 (95.8%)
High1 (4.2%)
Unknown0 (0.0%)
User Interaction
None19 (79.2%)
Unknown0 (0.0%)
Required5 (20.8%)
Privileges Required
Low10 (41.7%)
High2 (8.3%)
None12 (50.0%)
Unknown0 (0.0%)

Exploit Exposure

Signals from CVEs in this vendor scope (24 CVEs).

CISA KEV
0 CVEs
0.0% of CVEs· Bottom 1%
Metasploit
1 CVE
4.2% of CVEs· 98th percentile
Nuclei
1 CVE
4.2% of CVEs· 95th percentile
ExploitDB
7 CVEs
29.2% of CVEs· 79th percentile

Social Chatter

An overview of all social media posts that mention a CVE ID that affects a product developed by Peplink.

Media Mentions

Media articles that mention a CVE ID that affects a product developed by Peplink — matched by CVE ID, not by vendor name.

Top CNAs Publishing CVEs For Peplink's Products

View all 2 CNAs →

Top CWEs