PT-2024-12857 · Peplink · Peplink Smart Reader

Matt Wiseman

·

Published

2024-04-17

·

Updated

2025-08-21

·

CVE-2023-40146

CVSS v3.1

9.8

Critical

VectorAV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Name of the Vulnerable Software and Affected Versions Peplink Smart Reader version 1.2.0
Description A privilege escalation issue exists in the /bin/login functionality. A specially crafted command line argument can lead to a limited-shell escape and elevated capabilities. An attacker can authenticate with hard-coded credentials and execute unblocked default busybox functionality to trigger this issue.
Recommendations For Peplink Smart Reader version 1.2.0, consider disabling the /bin/login functionality until a patch is available. Restrict access to the default busybox functionality to minimize the risk of exploitation. Avoid using hard-coded credentials for authentication until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this issue.

Exploit

Fix

Using Hardcoded Credentials

Command Injection

Weakness Enumeration

CWE-798CWE-77

Related Identifiers

CVE-2023-40146

Affected Products

Peplink Smart Reader