CVE-2023-39367

HIGH 7.2CVE-2023-39367 · Published 17/04/2024 · updated 17/06/2026

Package	Affected versions	Patched versions
—	No affected product versions are listed for this vulnerability yet.

Description

An OS command injection vulnerability exists in the web interface mac2name functionality of Peplink Smart Reader v1.2.0 (in QEMU). A specially crafted HTTP request can lead to arbitrary command execution. An attacker can make an authenticated HTTP request to trigger this vulnerability.

References

forum.peplink.com/t/peplink-security-advisory-smart-reader-firmware-1-2-0-cve-2023-43491-cve-2023-45209-cve-2023-39367-cve-2023-45744-cve-2023-40146/47256 · Vendor Advisory
talosintelligence.com/vulnerability_reports/TALOS-2023-1867 · Exploit
talosintelligence.com/vulnerability_reports/TALOS-2023-1867

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free