Vulnerability · Published Apr 17, 2024 · Assigned by talos
CVE-2023-39367
Critical 9.1
In plain English
A critical-severity OS command injection in Smart Reader from Peplink. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 37.7% (higher than 99% of all known vulnerabilities).
Severity (CVSS 3.1)9.1Critical
Exploit odds (30 days)37.7%top 1.5% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
An OS command injection vulnerability exists in the web interface mac2name functionality of Peplink Smart Reader v1.2.0 (in QEMU). A specially crafted HTTP request can lead to arbitrary command execution. An attacker can make an authenticated HTTP request to trigger this vulnerability.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Peplink | Smart Reader | v1.2.0 (in QEMU) |
Weakness: CWE-78 · Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
References
- https://talosintelligence.com/vulnerability_reports/TALOS-2023-1867
- https://forum.peplink.com/t/peplink-security-advisory-smart-reader-firmware-1-2-0-cve-2023-43491-cve-2023-45209-cve-2023-39367-cve-2023-45744-cve-2023-40146/47256
- https://www.talosintelligence.com/vulnerability_reports/TALOS-2023-1867