CVE-2020-24246
Peplink Balance before 8.1.0rc1 allows an unauthenticated attacker to download PHP configuration...
Peplink Balance before 8.1.0rc1 allows an unauthenticated attacker to download PHP configuration files (/filemanager/php/connector.php) from Web Admin.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- None
- Availability
- None
Exploit likelihood
What each source reports
NVD Score used
Peplink Balance before 8.1.0rc1 allows an unauthenticated attacker to download PHP configuration files (/filemanager/php/connector.php) from Web Admin.
- Record
CVE-2020-24246- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N - CVSS 2.0
- 5.0 Medium
AV:N/AC:L/Au:N/C:P/I:N/A:N - Updated
- 2026-11-02
CVE List No score
Peplink Balance before 8.1.0rc1 allows an unauthenticated attacker to download PHP configuration files (/filemanager/php/connector.php) from Web Admin.
- Record
CVE-2020-24246- Updated
- 2026-11-02
EUVDEUVD-2020-16981 No score
Peplink Balance before 8.1.0rc1 allows an unauthenticated attacker to download PHP configuration files (/filemanager/php/connector.php) from Web Admin.
- Record
EUVD-2020-16981- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-873q-6mjj-g9m5 No score
Peplink Balance before 8.1.0rc1 allows an unauthenticated attacker to download PHP configuration...
Peplink Balance before 8.1.0rc1 allows an unauthenticated attacker to download PHP configuration files (/filemanager/php/connector.php) from Web Admin.
- Record
GHSA-873q-6mjj-g9m5- Updated
- 2026-11-02
Affected products
- peplink balance 1350 firmware
- peplink balance 20 firmware
- peplink balance 20x firmware
- peplink balance 210 firmware
- peplink balance 2500 firmware
- peplink balance 305 firmware
- peplink balance 30 firmware
- peplink balance 30 lte firmware
- peplink balance 30 pro firmware
- peplink balance 310 firmware
- peplink balance 310x firmware
- peplink balance 380 firmware
Show 43 moreShow less
- peplink balance 50 firmware
- peplink balance 580 firmware
- peplink balance 710 firmware
- peplink balance one firmware
- peplink balance two firmware
- peplink epx firmware
- peplink fusionhub firmware
- peplink max 700 firmware
- peplink max br1 ip67 firmware
- peplink max br1 classic firmware
- peplink max br1 ent firmware
- peplink max br1 ip55 firmware
- peplink max br1 m2m firmware
- peplink max br1 mini firmware
- peplink max br1 mk2 firmware
- peplink max br1 pro firmware
- peplink max br1 slim firmware
- peplink max br2 firmware
- peplink max br2 ip55 firmware
- peplink max hd1 dome firmware
- peplink max hd2 dome firmware
- peplink max hd2 firmware
- peplink max hd2 ip67 firmware
- peplink max hd2 mini firmware
- peplink max hd4 firmware
- peplink max hd4 ip67 firmware
- peplink max hotspot firmware
- peplink max on-the-go firmware
- peplink max transit duo firmware
- peplink max transit firmware
- peplink max transit mini firmware
- peplink mbx firmware
- peplink mediafast 200 firmware
- peplink mediafast 500 firmware
- peplink mediafast 750 firmware
- peplink mediafast hd2 firmware
- peplink mediafast hd4 firmware
- peplink sdx firmware
- peplink speedfusion sfe cam firmware
- peplink speedfusion sfe firmware
- peplink surf soho firmware
- peplink surf soho mk3 firmware
- peplink ubr lte firmware
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2020-24246 is a high vulnerability (CVSS 7.5) in Peplink Balance 1350 Firmware, published October 7, 2020. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.28%, the 70th percentile. No source names a fixed version.