CVE-2026-57920: Peplink InControl 2 Access Control Bypass via Semicolon Injection

Technical summary

CVE-2026-57920 is a path traversal variant classified as Insufficient Access Control (CWE-551). When an authenticated user crafts a request to a REST endpoint under `/rest/o/{orgId}` and includes a semicolon in the request path, the application's access-control logic fails to properly validate the intended organization context. This allows the attacker to read data or perform reconnaissance on organizations they should not have access to. The vulnerability was introduced in InControl 2 and persists through version 2.14.2; fixes were integrated after June 3, 2026.

Business impact

Organizations operating Peplink InControl 2 as a centralized management platform for branch connectivity and SD-WAN deployments face data exposure risk across multiple organizational tenants. An insider with basic user credentials—help desk staff, junior network engineers, managed service provider technicians—could enumerate and access customer or sibling organization configurations, including network topology, security policies, and operational settings. In multi-tenant MSP environments, this creates direct liability and trust erosion with clients. The impact is primarily confidentiality; integrity and availability of the control plane remain intact.

Affected systems

Peplink InControl 2 versions up to and including 2.14.2 are affected. Organizations must verify their installed version by checking the InControl 2 administration console. Patch status depends on whether the instance has been updated after June 3, 2026, or whether a subsequent patch release (post-2.14.2) has been deployed. Confirm against the Peplink security advisory for the exact version boundary and any interim patched builds.

Exploitability

Exploitation requires valid InControl 2 credentials and network access to the management console API. An attacker cannot exploit this anonymously; compromise of any user account (support staff, partner, internal network access) becomes a pivot point. The actual exploit is straightforward—injecting a semicolon into a URL path—meaning that once credentials are obtained, execution is low-friction. No special tools or advanced techniques are needed. The CVSS score of 7.7 (HIGH) reflects this combination: network-accessible, low complexity, but requiring prior authentication and limited to information disclosure.

Remediation

Upgrade InControl 2 to a patched release confirmed to be dated after June 3, 2026. Verify with your Peplink account team or security advisory that the target version includes the fix for CVE-2026-57920. Additionally, implement network segmentation to restrict API access to trusted administrative networks, enforce strong password policies and multi-factor authentication for console accounts, and audit access logs for suspicious REST API calls with unusual path patterns.

Patch guidance

Peplink has released patches post-2.14.2; consult the official Peplink security bulletin for the specific version number. Plan maintenance during a change window and test the upgrade in a staging environment first, as InControl 2 upgrades may affect active managed devices. Vendors often provide zero-downtime or scheduled-maintenance options; coordinate with your support team. After patching, verify the fix by confirming the new version number in the console and reviewing recent API access logs for any unauthorized cross-organization queries.

Detection guidance

Monitor InControl 2 API logs for requests to `/rest/o/{orgId}` endpoints containing semicolon characters in the path or query parameters. Alert on successful 200 responses from users accessing organization IDs outside their assigned scope. SIEM integration with InControl 2 audit logs can flag anomalous REST API patterns. Additionally, review user access logs to identify any low-privilege accounts making administrative API calls or cross-organization data retrieval attempts in the weeks before patching.

Why prioritize this

Although this vulnerability requires authentication and is not listed on CISA's Known Exploited Vulnerabilities (KEV) catalog, it carries meaningful risk in shared-infrastructure environments. Multi-tenant MSP deployments, partner networks, and large enterprises with federated organization structures should prioritize patching. The ease of exploitation once credentials are compromised, combined with direct exposure of operational and security configurations, justifies treating this as a high-priority patching task in the next scheduled change window.

Risk score, explained

The CVSS 3.1 score of 7.7 reflects a HIGH severity rating. The vector AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N indicates: network-accessible without physical proximity, low complexity to exploit (simple injection), requires low-privilege authenticated user, no user interaction needed, and impacts the confidentiality of resources beyond the vulnerable scope (cross-tenant data). The lack of integrity or availability impact keeps the score from reaching critical, but the broad scope and high confidentiality impact justify the HIGH rating.

Frequently asked questions