CVE-2017-8835: Peplink Balance routers SQL injection via bauth cookie

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 19 September 2026. Confidence: high.

critical priorityCVSS 3.0 base score is 9.8 with network, no-auth, no-interaction reachability, and public exploit code exists, making this a high-impact pre-auth SQL injection.

What it is

Peplink Balance 305, 380, 580, 710, 1350 and 2500 devices running firmware before 7.0.1-build2093 contain a SQL injection in cgi-bin/MANGA/admin.cgi reachable through the bauth cookie. Because the flaw is network-reachable with no privileges or user interaction, it exposes the device management interface to unauthenticated database manipulation.

Impact

An attacker can inject SQL through the bauth cookie, at minimum enumerating user accounts by observing whether a session ID is returned from the sessions database, and potentially reading or altering other data in the backend database.

Attack surface

Reached over the network by sending a crafted bauth cookie to cgi-bin/MANGA/admin.cgi on the affected Balance appliances; the CVSS vector indicates no authentication and no user interaction are required.

Exploitation

Not listed in CISA KEV, but EPSS is 0.61577 (99.1st percentile) and a public Exploit-DB entry (42130) exists, indicating exploit code is publicly available and exploitation is plausible.

What to do

• Upgrade affected Balance devices to firmware 7.0.1-build2093 or later, which the vendor advisory marks as the patched release.
• Restrict management interface access to trusted networks and disable remote/WAN-side administrative access where possible.
• Rotate administrative credentials and invalidate active sessions after patching, since session data may have been exposed.
• Monitor the vendor advisory and mailing list references for any updated guidance or later fixed builds.

Detection

• Inspect web and proxy logs for requests to cgi-bin/MANGA/admin.cgi with unusual or malformed bauth cookie values.
• Alert on SQL metacharacters (quotes, UNION, comment sequences) appearing in cookie headers sent to Balance management interfaces.
• Review authentication and session logs for anomalous session ID retrieval or repeated failed account lookups.
• Baseline normal bauth cookie formats and flag deviations from expected length or character set.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.