CVE-2017-8836: CSRF exists on Peplink Balance 305, 380, 580, 710, 1350, and 2500 devices with firmware before fw-b305hw2_3...

Security readout for executives and security teams

This issue lets a malicious website abuse a logged-in Peplink administrator’s browser to make unauthorized administrative changes. The cited example is changing the web admin credentials. Business risk is highest where affected Peplink Balance appliances are still on old firmware and administrators browse the web while authenticated to the management interface. Exposure is likely limited to organizations still running the listed Peplink Balance models on firmware older than 7.0.1 build2093. Risk increases if administrators access the management UI from normal browsing workstations or if the admin interface is reachable from broad networks. Prioritize remediation for internet-edge or business-critical Peplink appliances on old firmware. The issue can lead to administrative takeover, but the evidence provided does not show active exploitation and the attack depends on an authenticated administrator’s browser session. Mitigation focus: Upgrade affected appliances to firmware 7.0.1 build2093 or later vendor-supported firmware.; Restrict administrative interface access to trusted management networks only.; Avoid browsing external websites from systems logged into appliance admin consoles..

Prepared

Jun 13, 2026, 04:43 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.