CVE-2017-8839: XSS via orig_url exists on Peplink Balance 305, 380, 580, 710, 1350, and 2500 devices with firmware before...

Security readout for executives and security teams

CVE-2017-8839 is a cross-site scripting issue in Peplink Balance guest portal preview functionality. If an affected appliance runs older firmware, a user could be exposed to attacker-controlled script content through the vulnerable orig_url handling. Business impact depends on portal exposure and user interaction, but network edge devices should be prioritized for inventory and update. Exposure is limited to the listed Peplink Balance models with vulnerable firmware, especially where guest portal preview functionality is reachable by users or from untrusted networks. The source bundle does not identify other Peplink products, cloud services, or firmware branches as affected. Prioritize as an appliance hygiene and exposure-reduction item, not an emergency unless affected devices are internet-facing or heavily used for guest access. The absence of CVSS and KEV evidence lowers certainty, but public exploit publication increases remediation importance. Mitigation focus: Inventory the listed Peplink Balance models and record firmware versions.; Upgrade affected devices to the named fixed firmware build or later.; Check current vendor guidance before applying firmware in production..

Prepared

Jun 13, 2026, 04:43 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.