CVE-2023-39367
critical · 9.1An OS command injection vulnerability exists in the web interface mac2name functionality of Peplink Smart Reader v1.2.0 (in QEMU). A specially crafted HTTP request can lead to arbitrary command execution. An attacker can make an authenticated HTTP request to trigger this vulnerability.
9.1
CVSS
37.7%
EPSS (exploit prob.)
98th
EPSS percentile
2024-04-17
Published
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
Weaknesses
CWE-78
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| peplink | smart_reader_firmware | 1.2.0 |
| peplink | smart_reader | all versions |
Check a specific version with /api/v1/cve/match.
References
- https://forum.peplink.com/t/peplink-security-advisory-smart-reader-firmware-1-2-0-cve-2023-43491-cve-2023-45209-cve-2023-39367-cve-2023-45744-cve-2023-40146/47256
- https://talosintelligence.com/vulnerability_reports/TALOS-2023-1867
- https://forum.peplink.com/t/peplink-security-advisory-smart-reader-firmware-1-2-0-cve-2023-43491-cve-2023-45209-cve-2023-39367-cve-2023-45744-cve-2023-40146/47256
- https://talosintelligence.com/vulnerability_reports/TALOS-2023-1867
- https://www.talosintelligence.com/vulnerability_reports/TALOS-2023-1867
Query this programmatically:
curl https://evil-db.io/api/v1/cve/CVE-2023-39367