CVE-2017-8838: XSS via syncid exists on Peplink Balance 305, 380, 580, 710, 1350, and 2500 devices with firmware before fw...

Security readout for executives and security teams

CVE-2017-8838 is a cross-site scripting flaw in specific Peplink Balance devices running firmware before build 7.0.1-build2093. If exposed, it could let an attacker target users of the device web interface with injected script content. The provided sources do not show active exploitation or a CVSS score. Exposure is limited to organizations running the listed Peplink Balance models on firmware older than the named 7.0.1 build, especially where the affected CGI endpoint is reachable by untrusted users or networks. Treat this as a targeted network-appliance hygiene issue, not a confirmed emergency. Prioritize upgrades or access restrictions for exposed Peplink Balance devices, because public exploit material exists and management interfaces can create outsized operational risk. Mitigation focus: Inventory Peplink Balance 305, 380, 580, 710, 1350, and 2500 devices.; Upgrade affected devices to firmware 7.0.1-build2093 or later where supported.; Restrict access to device web management and HA sync paths to trusted networks..

Prepared

Jun 13, 2026, 04:43 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.