CVE-2023-49226: Peplink Balance Two Admin Console Traceroute Command Injection

CVE-2023-49226 is a command injection vulnerability in the traceroute diagnostic feature of the administration console of the Peplink Balance Two branch router: a user who already holds administrator privileges on the web interface can inject and execute arbitrary operating system commands as root, and NVD's own analysis rates the flaw 7.2 (high) on CVSS v3.1, reflecting that the attack requires an existing admin session rather than being exploitable pre-authentication.

CVE-2023-49226 affects the administration console of the Peplink Balance Two, a device Peplink describes as a "gigabit class branch router for demanding enterprise workloads" supporting SpeedFusion VPN. NVD's description states: "An issue was discovered in Peplink Balance Two before 8.4.0. Command injection in the traceroute feature of the administration console allows users with admin privileges to execute arbitrary commands as root" (NVD).

NVD's own Primary CVSS v3.1 score is 7.2 (high), vector CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H — network-reachable and low complexity, but requiring high privileges (PR:H, an existing admin session) to reach the vulnerable traceroute parameter, after which the attacker gains full confidentiality, integrity and availability impact by executing commands as root (NVD).

French security firm Synacktiv, which discovered and reported the flaw, describes it as "a command injection in the traceroute feature" of the admin console that lets "a user with administrator privileges execute arbitrary commands as root on the underlying system," fully compromising the device and "all the secrets it stores." Synacktiv disclosed it together with three related Balance Two issues in the same advisory: CVE-2023-49228 (a hard-coded root-access credential on the physical console port), CVE-2023-49229 (secrets readable by read-only users) and CVE-2023-49230 (a missing authorization check on captive portals). Its disclosure timeline records the advisory sent to Peplink on 2023-06-01, confirmation and a fix scheduled for version 8.4.0 on 2023-07-21, release of firmware 8.4.0 on 2023-10-05, and public disclosure on 2023-12-07, credited to researchers Louis Jacotot and Pierre Milioni (Synacktiv Security Advisory — Multiple vulnerabilities in Peplink Balance Two ≤ 8.3.0).

This CVE is not listed in the CISA Known Exploited Vulnerabilities catalog as of catalog version 2026.11.06, and FIRST scores the probability of exploitation at 0.03423 (89.0th percentile) as of 2026-11-08 — high for a privileged-access bug, consistent with command-injection flaws in router admin consoles remaining attractive once an attacker has obtained lower-level access (CISA KEV, FIRST EPSS).

Operators of Peplink Balance Two routers on firmware older than 8.4.0 should update, and should treat admin-console access itself as a high-value credential: because exploitation requires only an existing admin session (not root), limiting which accounts and networks can reach the administration console reduces the impact of any separately compromised admin credential.

• An issue was discovered in Peplink Balance Two before 8.4.0: command injection in the traceroute feature of the administration console allows users with admin privileges to execute arbitrary commands as root. — NVD
• NVD's own Primary CVSS v3.1 score is 7.2, vector CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H. — NVD
• Discovered by Synacktiv researchers Louis Jacotot and Pierre Milioni; disclosed alongside CVE-2023-49228, CVE-2023-49229 and CVE-2023-49230; affects versions 8.1.2 to 8.3.0 (earlier versions likely vulnerable); reported 2023-06-01, fixed in 8.4.0 released 2023-10-05, publicly disclosed 2023-12-07. — Synacktiv Security Advisory — Multiple vulnerabilities in Peplink Balance Two ≤ 8.3.0
• Not present in the CISA KEV catalog as of catalog version 2026.11.06; EPSS score is 0.03423 (89.0th percentile) as of 2026-11-08. — FIRST EPSS