CRITICAL
An OS command injection vulnerability exists in the web interface mac2name functionality of Peplink Smart Reader v1.2.0 (in QEMU)
Published Apr 17, 2024
9.1
CRITICALCVSS 3.1
EPSS 37.68%
Description
An OS command injection vulnerability exists in the web interface mac2name functionality of Peplink Smart Reader v1.2.0 (in QEMU). A specially crafted HTTP request can lead to arbitrary command execution. An attacker can make an authenticated HTTP request to trigger this vulnerability.
Affected products
-
- Version v1.2.0 (in QEMU)StatusaffectedConstraints-
- Version
Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).
| Vendor | Product | Default status | Versions | ||||||
|---|---|---|---|---|---|---|---|---|---|
| Peplink | Smart Reader | n/a |
|
AND
- 1.2.0
Running on/with
- n/a
-
- Version v1.2.0StatusaffectedConstraints-
- Version
Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).
| Vendor | Product | Default status | Versions | ||||||
|---|---|---|---|---|---|---|---|---|---|
| Peplink | Smart Reader | n/a |
|
No Red Hat product state for this CVE.
No package ranges for this CVE.
Remediation
No remediation recorded yet.
Weaknesses (1)
References (3)
- https://forum.peplink.com/t/peplink-security-advisory-smart-reader-firmware-1-2-0-cve-2023-43491-cve-2023-45209-cve-2023-39367-cve-2023-45744-cve-2023-40146/47256 Vendor Advisory
- https://talosintelligence.com/vulnerability_reports/TALOS-2023-1867 ExploitThird Party Advisory
- https://www.talosintelligence.com/vulnerability_reports/TALOS-2023-1867
Change history (0)
No recorded changes yet.
Sources
CVE.org / MITRE
Status PUBLISHED
Assigner talos
Published Apr 17, 2024
Updated Nov 4, 2025
Reserved Nov 22, 2023
Link CVE-2023-39367
CISA Vulnrichment
Updated Apr 19, 2024