CVE-2026-57920

High

Peplink InControl 2 through 2.14.2 before 2026-06-03 allows use of a semicolon to bypass access-control rules for certain /rest/o/{orgId}…

mitre·CWE-551·Published 2026-06-26

CVSS

7.7

EPSS

0.00

KEV

Exploits

Tags:exclusively-hosted-service

cve.orgen

148 chars

Peplink InControl 2 through 2.14.2 before 2026-06-03 allows use of a semicolon to bypass access-control rules for certain /rest/o/{orgId} endpoints.

NVDen

148 chars

Peplink InControl 2 through 2.14.2 before 2026-06-03 allows use of a semicolon to bypass access-control rules for certain /rest/o/{orgId} endpoints.

Peplink InControl 2 hasta la versión 2.14.2 anterior al 03-06-2026 permite el uso de un punto y coma para eludir las reglas de control de acceso para ciertos puntos finales /rest/o/{orgId}.

CVSS metrics across sources

Version	Type	Source	Base	Exp	Impact	Vector
3.1	Primary	cve.org	7.7	—	—	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N
3.1	Secondary	NVD	7.7	3.1	4.0	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N
3.1	Secondary	ENISA EUVD	7.7	—	—	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N