Cyber Resilience

CVE-2026-57920

Peplink Intcontrol 2 ≤ 2.14.2

Public PoC
Published
26 June 2026
Modified
02 July 2026
CVSS Score v3.1 7.7
Click a component to see what it means
Raw vectorCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N
EPSS Score 0.0026 18th percentile
Risk Priority 53 floored blend · peak EPSS

Summary

CVE-2026-57920 is a high-severity Incorrect Behavior Order: Authorization Before Parsing and Canonicalization (CWE-551) vulnerability in Peplink Intcontrol 2. Its CVSS base score is 7.7 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 18th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.

The strongest mitigations our analysis identified map to AC-3 (Access Enforcement) and SI-10 (Information Input Validation) — see the control section below for these in your framework.

EU & UK References

Vulnerability Data

Peplink InControl 2 through 2.14.2 before 2026-06-03 allows use of a semicolon to bypass access-control rules for certain /rest/o/{orgId} endpoints.

CWE(s)
CWE-551

Related Threats

MITRE ATT&CK Enterprise Techniques

T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
attack.mitre.org →
Derived from this CVE’s CWE(s) via the direct CWE→ATT&CK cross-walk.

CVEs Like This One

CVE-2017-8835Same vendor: Peplink
CVE-2026-0707Shared CWE-551
CVE-2026-4636Shared CWE-551
CVE-2016-20030Shared CWE-551
CVE-2023-39367Same vendor: Peplink
CVE-2023-27380Same vendor: Peplink
CVE-2023-35194Same vendor: Peplink
CVE-2023-34356Same vendor: Peplink
CVE-2023-35193Same vendor: Peplink
CVE-2023-49229Same vendor: Peplink

Affected Assets

peplink
intcontrol 2
≤ 2.14.2

Mitigating Controls

Mitigating Controls (NIST 800-53 r5) AI

AC-3 Access Enforcement good match

AC-3 requires correct enforcement of authorizations on requests, which structurally demands parsing and canonicalization occur first so that the check cannot be bypassed.

SI-10 Information Input Validation partial match

SI-10 mandates validation (including canonicalization) of inputs before security decisions are made, directly stopping the incorrect ordering that enables the bypass.

Mitigating Controls (NIST CSF 2.0) AI

Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.

PR.PS-06 mostly match
prevents

Secure SDLC practices directly require correct authorization logic after parsing/canonicalization to prevent bypasses.

Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI

Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.

A.8.29 Security testing in development and acceptance mostly match
finds

Security testing can detect this weakness but does not prevent it by itself.

A.8.25 Secure development life cycle partial match
prevents

Secure development lifecycle requires proper URL parsing and canonicalization before authorization checks.

A.8.26 Application security requirements partial match
prevents

Application security requirements should mandate correct authorization order after canonicalization.

A.8.27 Secure system architecture and engineering principles partial match
prevents

Secure architecture principles include proper request handling order to prevent bypasses.

A.8.28 Secure coding partial match
prevents

Secure coding practices directly address canonicalization and authorization sequencing flaws.

A.8.3 Information access restriction partial match
mitigates

Information access restriction is undermined when authorization occurs before canonicalization.

References