CVE-2023-45744

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2023-45744
A data integrity vulnerability exists in the web interface /cgi-bin/upload_config.cgi functionality of Peplink Smart Reader v1.2.0 (in QEMU). A specially crafted HTTP request can lead to configuration modification. An attacker can make an unauthenticated HTTP request to trigger this vulnerability.

8.3 /10

CVSS v3 : HIGH

V3 Legend

Vector :

Exploitability : 2.8 / Impact : 5.5

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction REQUIRED

Confidentiality Impact LOW

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References
Link Resource
https://forum.peplink.com/t/peplink-security-advisory-smart-reader-firmware-1-2-0-cve-2023-43491-cve-2023-45209-cve-2023-39367-cve-2023-45744-cve-2023-40146/47256 Vendor Advisory
https://talosintelligence.com/vulnerability_reports/TALOS-2023-1866 Exploit Third Party Advisory
https://forum.peplink.com/t/peplink-security-advisory-smart-reader-firmware-1-2-0-cve-2023-43491-cve-2023-45209-cve-2023-39367-cve-2023-45744-cve-2023-40146/47256 Vendor Advisory
https://security.netapp.com/advisory/ntap-20240828-0006/ Third Party Advisory
https://talosintelligence.com/vulnerability_reports/TALOS-2023-1866 Exploit Third Party Advisory
Configurations

Configuration 1 (hide)

AND
cpe:2.3:o:peplink:smart_reader_firmware:1.2.0:*:*:*:*:*:*:*
cpe:2.3:h:peplink:smart_reader:-:*:*:*:*:*:*:*
History

21 Aug 2025, 18:01

Type Values Removed Values Added
CWE NVD-CWE-noinfo
CPE cpe:2.3:h:peplink:smart_reader:-:*:*:*:*:*:*:*
cpe:2.3:o:peplink:smart_reader_firmware:1.2.0:*:*:*:*:*:*:*
First Time Peplink smart Reader
Peplink
Peplink smart Reader Firmware
References () https://forum.peplink.com/t/peplink-security-advisory-smart-reader-firmware-1-2-0-cve-2023-43491-cve-2023-45209-cve-2023-39367-cve-2023-45744-cve-2023-40146/47256 - () https://forum.peplink.com/t/peplink-security-advisory-smart-reader-firmware-1-2-0-cve-2023-43491-cve-2023-45209-cve-2023-39367-cve-2023-45744-cve-2023-40146/47256 - Vendor Advisory
References () https://talosintelligence.com/vulnerability_reports/TALOS-2023-1866 - () https://talosintelligence.com/vulnerability_reports/TALOS-2023-1866 - Exploit, Third Party Advisory
References () https://security.netapp.com/advisory/ntap-20240828-0006/ - () https://security.netapp.com/advisory/ntap-20240828-0006/ - Third Party Advisory

21 Nov 2024, 08:27

Type Values Removed Values Added
Summary
  • (es) Existe una vulnerabilidad de integridad de datos en la funcionalidad de la interfaz web /cgi-bin/upload_config.cgi de Peplink Smart Reader v1.2.0 (en QEMU). Una solicitud HTTP especialmente manipulada puede provocar una modificación de la configuración. Un atacante puede realizar una solicitud HTTP no autenticada para desencadenar esta vulnerabilidad.
References
  • () https://security.netapp.com/advisory/ntap-20240828-0006/ -
References () https://forum.peplink.com/t/peplink-security-advisory-smart-reader-firmware-1-2-0-cve-2023-43491-cve-2023-45209-cve-2023-39367-cve-2023-45744-cve-2023-40146/47256 - () https://forum.peplink.com/t/peplink-security-advisory-smart-reader-firmware-1-2-0-cve-2023-43491-cve-2023-45209-cve-2023-39367-cve-2023-45744-cve-2023-40146/47256 -
References () https://talosintelligence.com/vulnerability_reports/TALOS-2023-1866 - () https://talosintelligence.com/vulnerability_reports/TALOS-2023-1866 -

17 Apr 2024, 17:15

Type Values Removed Values Added
References
  • {'url': 'https://www.talosintelligence.com/vulnerability_reports/TALOS-2023-1866', 'source': 'talos-cna@cisco.com'}

17 Apr 2024, 14:15

Type Values Removed Values Added
References
  • () https://www.talosintelligence.com/vulnerability_reports/TALOS-2023-1866 -

17 Apr 2024, 13:15

Type Values Removed Values Added
New CVE
Information

Published : 2024-04-17 13:15

Updated : 2025-08-21 18:01

NVD link : CVE-2023-45744

Mitre link : CVE-2023-45744

CVE.ORG link : CVE-2023-45744

JSON object : View

Products Affected

peplink

  • smart_reader
  • smart_reader_firmware
CWE
CWE-284

Improper Access Control

NVD-CWE-noinfo