CVSS 3.1
7.5 highCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:NCVE-2020-24246
High (7.5) in peplink. EPSS 1.3% chance of exploitation in the next 30 days.
Peplink Balance before 8.1.0rc1 allows an unauthenticated attacker to download PHP configuration files (/filemanager/php/connector.php) from Web Admin.
Severity
- EPSS
- 1.3% chance of exploitation in the next 30 days; higher than 70% of CVEs (scores of 2026-10-31)
- Published
- Modified
- Record from
- the NVD, synced
Affected
- peplink:balance_1350_firmware
- peplink:balance_20_firmware
- peplink:balance_20x_firmware
- peplink:balance_210_firmware
- peplink:balance_2500_firmware
- peplink:balance_305_firmware
- peplink:balance_30_firmware
- peplink:balance_30_lte_firmware
- peplink:balance_30_pro_firmware
- peplink:balance_310_firmware
- peplink:balance_310x_firmware
- peplink:balance_380_firmware
- peplink:balance_50_firmware
- peplink:balance_580_firmware
- peplink:balance_710_firmware
- peplink:balance_one_firmware
- peplink:balance_two_firmware
- peplink:epx_firmware
- peplink:fusionhub_firmware
- peplink:max_700_firmware
- peplink:max_br1__ip67_firmware
- peplink:max_br1_classic_firmware
- peplink:max_br1_ent_firmware
- peplink:max_br1_ip55_firmware
- peplink:max_br1_m2m_firmware
- peplink:max_br1_mini_firmware
- peplink:max_br1_mk2_firmware
- peplink:max_br1_pro_firmware
- peplink:max_br1_slim_firmware
- peplink:max_br2_firmware
- peplink:max_br2_ip55_firmware
- peplink:max_hd1_dome_firmware
- peplink:max_hd2_dome_firmware
- peplink:max_hd2_firmware
- peplink:max_hd2_ip67_firmware
- peplink:max_hd2_mini_firmware
- peplink:max_hd4_firmware
- peplink:max_hd4_ip67_firmware
- peplink:max_hotspot_firmware
- peplink:max_on-the-go_firmware
- peplink:max_transit_duo_firmware
- peplink:max_transit_firmware
- peplink:max_transit_mini_firmware
- peplink:mbx_firmware
- peplink:mediafast_200_firmware
- peplink:mediafast_500_firmware
- peplink:mediafast_750_firmware
- peplink:mediafast_hd2_firmware
- peplink:mediafast_hd4_firmware
- peplink:sdx_firmware
References
- https://blog.bssi.fr/cve-2020-24246-leaking-source-file-using-the-web-admin-interface-of-peplink-balance/
- https://download.peplink.com/resources/firmware-8.1.0rc1-release-notes.pdf
- https://blog.bssi.fr/cve-2020-24246-leaking-source-file-using-the-web-admin-interface-of-peplink-balance/
- https://download.peplink.com/resources/firmware-8.1.0rc1-release-notes.pdf