What’s Vulnerable › Vulnerabilities

CVE-2020-24246

• Severity: high (CVSS 7.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 1.3% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2020-10-07 · updated 2026-06-17

Description

Peplink Balance before 8.1.0rc1 allows an unauthenticated attacker to download PHP configuration files (/filemanager/php/connector.php) from Web Admin.

Affected products

• Peplink Balance 1350 Firmware: through 8.1.0
• Peplink Balance 20 Firmware: through 8.1.0
• Peplink Balance 20X Firmware: through 8.1.0
• Peplink Balance 210 Firmware: through 8.1.0
• Peplink Balance 2500 Firmware: through 8.1.0
• Peplink Balance 305 Firmware: through 8.1.0
• Peplink Balance 30 Firmware: through 8.1.0
• Peplink Balance 30 Lte Firmware: through 8.1.0
• Peplink Balance 30 Pro Firmware: through 8.1.0
• Peplink Balance 310 Firmware: through 8.1.0
• Peplink Balance 310X Firmware: through 8.1.0
• Peplink Balance 380 Firmware: through 8.1.0
• Peplink Balance 50 Firmware: through 8.1.0
• Peplink Balance 580 Firmware: through 8.1.0
• Peplink Balance 710 Firmware: through 8.1.0
• Peplink Balance One Firmware: through 8.1.0
• Peplink Balance Two Firmware: through 8.1.0
• Peplink Epx Firmware: through 8.1.0
• Peplink Fusionhub Firmware: through 8.1.0
• Peplink Max 700 Firmware: through 8.1.0
• Peplink Max Br1 Ip67 Firmware: through 8.1.0
• Peplink Max Br1 Classic Firmware: through 8.1.0
• Peplink Max Br1 Ent Firmware: through 8.1.0
• Peplink Max Br1 Ip55 Firmware: through 8.1.0
• Peplink Max Br1 M2M Firmware: through 8.1.0
• Peplink Max Br1 Mini Firmware: through 8.1.0
• Peplink Max Br1 Mk2 Firmware: through 8.1.0
• Peplink Max Br1 Pro Firmware: through 8.1.0
• Peplink Max Br1 Slim Firmware: through 8.1.0
• Peplink Max Br2 Firmware: through 8.1.0

References

• https://blog.bssi.fr/cve-2020-24246-leaking-source-file-using-the-web-admin-interface-of-peplink-balance/
• https://download.peplink.com/resources/firmware-8.1.0rc1-release-notes.pdf
• https://blog.bssi.fr/cve-2020-24246-leaking-source-file-using-the-web-admin-interface-of-peplink-balance/
• https://download.peplink.com/resources/firmware-8.1.0rc1-release-notes.pdf

Get alerted when CVE-2020-24246 or the next vulnerability affects your stack