CVE-2023-28381
📋 TL;DR
This vulnerability allows authenticated attackers to execute arbitrary operating system commands on Peplink Surf SOHO HW1 devices via command injection in the admin.cgi MVPN_trial_init functionality. Attackers can achieve remote code execution by sending specially crafted HTTP requests. Only users of affected Peplink Surf SOHO HW1 devices running vulnerable firmware versions are impacted.
💻 Affected Systems
- Peplink Surf SOHO HW1
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Full device compromise allowing attacker to install persistent backdoors, pivot to internal networks, steal credentials, or use device as part of botnet.
Likely Case
Unauthorized administrative access leading to configuration changes, network disruption, or data exfiltration.
If Mitigated
Limited impact if proper network segmentation and authentication controls prevent exploitation attempts.
🎯 Exploit Status
Exploitation requires authenticated access but command injection is straightforward once authenticated.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: v6.3.6 or later
Vendor Advisory: https://www.peplink.com/support/security-advisories/
Restart Required: Yes
Instructions:
1. Log into device admin interface. 2. Navigate to System > Firmware. 3. Check for and install latest firmware update. 4. Reboot device after update completes.
🔧 Temporary Workarounds
Restrict Admin Interface Access
allLimit access to admin interface to trusted IP addresses only
Configure firewall rules to restrict access to device admin port (typically 443/HTTPS)
Disable Unused Features
allDisable MVPN trial functionality if not required
Navigate to admin interface > VPN > MVPN and disable trial features
🧯 If You Can't Patch
- Implement strict network segmentation to isolate vulnerable devices from critical assets
- Enforce strong authentication policies and monitor for suspicious admin login attempts
🔍 How to Verify
Check if Vulnerable:
Check firmware version in admin interface under System > Firmware. If version is v6.3.5 or earlier, device is vulnerable.Check Version:
Login to admin web interface and navigate to System > Firmware pageVerify Fix Applied:
Verify firmware version shows v6.3.6 or later after update.📡 Detection & Monitoring
Log Indicators:
- Unusual admin login patterns
- HTTP requests to admin.cgi with MVPN_trial_init containing shell metacharacters
- Unexpected system command execution in logs
Network Indicators:
- HTTP POST requests to admin.cgi endpoint with command injection payloads
- Unusual outbound connections from device
SIEM Query:
source="peplink" AND (uri="*/admin.cgi*" AND (method="POST" OR method="GET") AND (query="*MVPN_trial_init*" AND (query="*;*" OR query="*|*" OR query="*`*")))