CVE-2023-45744: Improper Access Control

A data integrity vulnerability exists in the web interface /cgi-bin/uploadconfig.cgi functionality of Peplink Smart Reader v1.2.0 in QEMU. A specially crafted HTTP request can lead to configuration modification. An attacker can make an unauthenticated HTTP request to trigger this vulnerability...

CVE-2023-45209: Improper Access Control

An information disclosure vulnerability exists in the web interface /cgi-bin/downloadconfig.cgi functionality of Peplink Smart Reader v1.2.0 in QEMU. A specially crafted HTTP request can lead to a disclosure of sensitive information. An attacker can make an unauthenticated HTTP request to trigger...

PT-2024-12857 · Peplink · Peplink Smart Reader

Name of the Vulnerable Software and Affected Versions: Peplink Smart Reader version 1.2.0 Description: A privilege escalation issue exists in the /bin/login functionality. A specially crafted command line argument can lead to a limited-shell escape and elevated capabilities. An attacker can...

Peplink Smart Reader web interface /cgi-bin/download_config.cgi information disclosure vulnerability

Talos Vulnerability Report TALOS-2023-1865 Peplink Smart Reader web interface /cgi-bin/downloadconfig.cgi information disclosure vulnerability April 17, 2024 CVE Number CVE-2023-45209 SUMMARY An information disclosure vulnerability exists in the web interface /cgi-bin/downloadconfig.cgi...

PT-2024-13229 · Peplink · Peplink Smart Reader

Name of the Vulnerable Software and Affected Versions: Peplink Smart Reader version 1.2.0 Description: An information disclosure vulnerability exists in the web interface functionality of the /cgi-bin/download config.cgi endpoint. A specially crafted HTTP request can lead to a disclosure of...

Peplink Smart Reader: Operating System Command Injection Vulnerability

Peplink Smart Reader is a smart reader from Peplink Inc. It is used for employee time and attendance. An operating system command injection vulnerability exists in Peplink Smart Reader v1.2.0, which stems from the presence of an operating system command injection vulnerability that could lead to...

Peplink Smart Reader Access Control Vulnerability

Peplink Smart Reader is a smart reader from Peplink Inc. It is used for employee time and attendance. An access control error vulnerability exists in Peplink Smart Reader v1.2.0, which stems from the presence of an information disclosure vulnerability that could lead to the disclosure of sensitiv...

Peplink Smart Reader Access Control Vulnerability

Peplink Smart Reader is a smart reader from Peplink Inc. It is used for employee time and attendance. An access control error vulnerability exists in Peplink Smart Reader version v1.2.0, which stems from the presence of a data integrity vulnerability that could lead to configuration modifications...

Peplink Smart Reader web interface mac2name OS command injection vulnerability

Talos Vulnerability Report TALOS-2023-1867 Peplink Smart Reader web interface mac2name OS command injection vulnerability April 17, 2024 CVE Number CVE-2023-39367 SUMMARY An OS command injection vulnerability exists in the web interface mac2name functionality of Peplink Smart Reader v1.2.0 in QEM...

Peplink Smart Reader Access Control Vulnerability

Peplink Smart Reader is a smart reader from Peplink Inc. It is used for employee time and attendance. An access control error vulnerability exists in Peplink Smart Reader v1.2.0, which stems from the presence of an information disclosure vulnerability that could lead to the disclosure of sensitiv...

Peplink Smart Reader web interface /cgi-bin/debug_dump.cgi information disclosure vulnerability

Talos Vulnerability Report TALOS-2023-1863 Peplink Smart Reader web interface /cgi-bin/debugdump.cgi information disclosure vulnerability April 17, 2024 CVE Number CVE-2023-43491 SUMMARY An information disclosure vulnerability exists in the web interface /cgi-bin/debugdump.cgi functionality of...

CVE-2023-40146: Improper Neutralization of Special Elements used in a Command

A privilege escalation vulnerability exists in the /bin/login functionality of Peplink Smart Reader v1.2.0 in QEMU. A specially crafted command line argument can lead to a limited-shell escape and elevated capabilities. An attacker can authenticate with hard-coded credentials and execute unblocke...

CVE-2023-43491: Improper Access Control

An information disclosure vulnerability exists in the web interface /cgi-bin/debugdump.cgi functionality of Peplink Smart Reader v1.2.0 in QEMU. A specially crafted HTTP request can lead to a disclosure of sensitive information. An attacker can make an unauthenticated HTTP request to trigger this...

Peplink Smart Reader Trust Management Vulnerability

Peplink Smart Reader is a smart card reader from Peplink Inc. It is used for employee time and attendance. A command injection vulnerability exists in Peplink Smart Reader v1.2.0, which stems from the presence of an elevation-of-privilege vulnerability, where an attacker can cause limited shell...

Peplink Smart Reader /bin/login privilege escalation vulnerability

Talos Vulnerability Report TALOS-2023-1868 Peplink Smart Reader /bin/login privilege escalation vulnerability April 17, 2024 CVE Number CVE-2023-40146 SUMMARY A privilege escalation vulnerability exists in the /bin/login functionality of Peplink Smart Reader v1.2.0 in QEMU. A specially crafted...

CVE-2023-39367: Improper Neutralization of Special Elements used in an OS Command

An OS command injection vulnerability exists in the web interface mac2name functionality of Peplink Smart Reader v1.2.0 in QEMU. A specially crafted HTTP request can lead to arbitrary command execution. An attacker can make an authenticated HTTP request to trigger this vulnerability...

CVE-2024-32488

In Foxit PDF Reader and Editor before 2024.1, Local Privilege Escalation could occur during update checks because weak permissions on the update-service folder allow attackers to place crafted DLL files there...

CVE-2024-32488

In Foxit PDF Reader and Editor before 2024.1, Local Privilege Escalation could occur during update checks because weak permissions on the update-service folder allow attackers to place crafted DLL files there...

CVE-2024-32488: Improper Handling of Insufficient Permissions or Privileges

In Foxit PDF Reader and Editor before 2024.1, Local Privilege Escalation could occur during update checks because weak permissions on the update-service folder allow attackers to place crafted DLL files there...

CVE-2024-32488

Foxit PDF Reader and Editor versions before 2024.1 are susceptible to a Local Privilege Escalation vulnerability. The root cause is weak permissions on the update-service folder, which allows an attacker to place crafted DLL files there during update checks to elevate privileges. No specific expl...