CVE-2023-49230

HighCVSS 8.8/10Last modified Jun 17, 2026

Description

An issue was discovered in Peplink Balance Two before 8.4.0. A missing authorization check in captive portals allows attackers to modify the portals' configurations without prior authentication.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-862

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

https://www.synacktiv.com/publications%253Ffield_tags_target_id%253D4Third Party Advisory
https://www.synacktiv.com/sites/default/files/2023-12/synacktiv-peplink-multiple-vulnerabilities.pdfExploit, Third Party Advisory
https://www.synacktiv.com/publications%253Ffield_tags_target_id%253D4Third Party Advisory
https://www.synacktiv.com/sites/default/files/2023-12/synacktiv-peplink-multiple-vulnerabilities.pdfExploit, Third Party Advisory

Timeline

Published: Dec 28, 2023
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2023

CVE-2023-492319.8An authentication bypass vulnerability was found in Stilog Visual Planning 8. It allows an unauthenticated attacker to receive an administra CVE-2023-492329.8An authentication bypass vulnerability was found in Stilog Visual Planning 8. It allows an unauthenticated attacker to brute-force the passw CVE-2023-492338.8Insufficient access checks in Visual Planning Admin Center 8 before v.1 Build 240207 allow attackers in possession of a non-administrative V CVE-2023-492346.3An XML external entity (XXE) vulnerability was found in Stilog Visual Planning 8. It allows an authenticated attacker to access local server CVE-2023-492359.8An issue was discovered in libremote_dbg.so on TRENDnet TV-IP1314PI 5.5.3 200714 devices. Filtering of debug information is mishandled durin CVE-2023-492369.8A stack-based buffer overflow was discovered on TRENDnet TV-IP1314PI 5.5.3 200714 devices, leading to arbitrary command execution. This occu CVE-2023-492379.8An issue was discovered on TRENDnet TV-IP1314PI 5.5.3 200714 devices. Command injection can occur because the system function is used by dav CVE-2023-492389.8In Gradle Enterprise before 2023.1, a remote attacker may be able to gain access to a new installation (in certain installation scenarios) b CVE-2023-492397.5Unauthorized access vulnerability in the card management module. Successful exploitation of this vulnerability may affect service confidenti CVE-2023-49244.3The BEAR for WordPress is vulnerable to Missing Authorization in versions up to, and including, 1.1.3.3. This is due to missing capability c CVE-2023-492407.5Unauthorized access vulnerability in the launcher module. Successful exploitation of this vulnerability may affect service confidentiality.CVE-2023-492417.5API permission control vulnerability in the network management module. Successful exploitation of this vulnerability may affect service conf