CVE-2017-8835: SQL injection exists on Peplink Balance 305, 380, 580, 710, 1350, and 2500 devices with firmware before fw-...

Security readout for executives and security teams

This flaw affects older Peplink Balance appliances. A malicious request involving the management interface cookie could trigger SQL injection and may let an attacker enumerate user accounts. The bundle does not prove active exploitation, but it does cite a public exploit listing, so exposed legacy devices deserve prompt attention. Organizations using listed Peplink Balance models on firmware older than the named 7.0.1 build are the likely exposure group, especially where the management interface is reachable from untrusted networks. Treat as a priority for legacy edge-device hygiene. The issue affects network appliances and has public exploit material, but the provided evidence does not show confirmed active exploitation. Mitigation focus: Upgrade affected devices to the named fixed firmware build or a vendor-supported newer release.; Check Peplink and X41 guidance for model-specific remediation details.; Restrict management interface reachability to trusted administrative networks..

Prepared

Jun 13, 2026, 04:43 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.