PT-2024-13084 · Peplink · Peplink Smart Reader

Matt Wiseman · Published 2023-11-30 · Updated 2025-08-21 · CVE-2023-43491

Positive Technologies (AI Summary)

CVSS v2.0

9.7

High

Base vector

AV:N/AC:L/Au:N/C:P/I:C/A:C

Name of the Vulnerable Software and Affected Versions Peplink Smart Reader version 1.2.0

Description An information disclosure vulnerability exists in the web interface /cgi-bin/debug dump.cgi functionality. A specially crafted HTTP request can lead to a disclosure of sensitive information. An attacker can make an unauthenticated HTTP request to trigger this issue.

Recommendations For Peplink Smart Reader version 1.2.0, consider disabling access to the /cgi-bin/debug dump.cgi endpoint until a patch is available. Restrict access to sensitive information to minimize the risk of exploitation.

Exploit

Fix

Improper Access Control

OS Command Injection

Weakness Enumeration

CWE-284

CWE-78

Related Identifiers

BDU:2024-03302

BDU:2024-03718

CVE-2023-43491

Affected Products

Peplink Smart Reader

References · 35

• 🔥 https://talosintelligence.com/vulnerability_reports/TALOS-2023-1863 · Exploit
• https://bdu.fstec.ru/vul/2024-03302 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2023-43491 · Security Note
• https://forum.peplink.com/t/peplink-security-advisory-smart-reader-firmware-1-2-0-cve-2023-43491-cve-2023-45209-cve-2023-39367-cve-2023-45744-cve-2023-40146/47256 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2023-43491 · Vendor Advisory
• https://bdu.fstec.ru/vul/2024-03718 · Security Note
• https://t.me/cvenotify/77144 · Telegram Post
• https://talosintelligence.com/vulnerability_reports/TALOS-2023-1866 · Note
• https://t.me/cvenotify/77082 · Telegram Post
• https://t.me/cvenotify/77083 · Telegram Post
• https://t.me/cvenotify/77148 · Telegram Post
• https://t.me/cvenotify/77145 · Telegram Post
• https://t.me/cvenotify/77116 · Telegram Post
• https://t.me/cveNotify/133051 · Telegram Post
• https://security.netapp.com/advisory/ntap-20240828-0005 · Note