CVE-2023-49230
📋 TL;DR
This vulnerability allows unauthenticated attackers to modify captive portal configurations on Peplink Balance Two routers. Attackers can change portal settings without any authentication, potentially redirecting users to malicious sites or capturing credentials. Organizations using Peplink Balance Two routers with firmware versions before 8.4.0 are affected.
💻 Affected Systems
- Peplink Balance Two
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Attackers could completely reconfigure captive portals to redirect all users to phishing sites, capture login credentials, or deploy malware through modified portal content.
Likely Case
Attackers modify portal configurations to inject malicious content, redirect users to phishing pages, or disrupt legitimate portal functionality.
If Mitigated
With proper network segmentation and monitoring, impact is limited to isolated network segments, but portal integrity remains compromised.
🎯 Exploit Status
The vulnerability requires no authentication and involves simple HTTP requests to modify portal configurations. While no public PoC exists, the technical details are straightforward.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 8.4.0
Vendor Advisory: https://www.peplink.com/support/security-advisories/
Restart Required: Yes
Instructions:
1. Log into Peplink web admin interface. 2. Navigate to System > Firmware. 3. Check for and install firmware version 8.4.0 or later. 4. Reboot the router after installation completes.
🔧 Temporary Workarounds
Disable Captive Portals
allTemporarily disable captive portal functionality until patching is possible.
Network Segmentation
allIsolate the management interface from untrusted networks using firewall rules.
🧯 If You Can't Patch
- Implement strict network access controls to limit access to the router's management interface
- Enable detailed logging and monitoring for unauthorized configuration changes to captive portals
🔍 How to Verify
Check if Vulnerable:
Check firmware version in web admin interface under System > Firmware. If version is below 8.4.0, the system is vulnerable.Check Version:
No CLI command available. Check via web interface at System > Firmware.Verify Fix Applied:
After updating, verify firmware version shows 8.4.0 or higher in System > Firmware. Test captive portal configuration changes require authentication.📡 Detection & Monitoring
Log Indicators:
- Unauthorized configuration changes to captive portal settings
- Failed authentication attempts followed by successful configuration modifications
Network Indicators:
- HTTP POST requests to captive portal configuration endpoints without authentication headers
- Unusual changes to portal redirect URLs or content
SIEM Query:
source="peplink-router" AND (event_type="config_change" AND user="anonymous") OR (uri_path="/captive-portal/config" AND http_method="POST" AND NOT auth_success="true")🔗 References
- https://www.synacktiv.com/publications%253Ffield_tags_target_id%253D4
- https://www.synacktiv.com/sites/default/files/2023-12/synacktiv-peplink-multiple-vulnerabilities.pdf
- https://www.synacktiv.com/publications%253Ffield_tags_target_id%253D4
- https://www.synacktiv.com/sites/default/files/2023-12/synacktiv-peplink-multiple-vulnerabilities.pdf
