CVE-2023-40146

A privilege escalation vulnerability exists in the /bin/login functionality of Peplink Smart Reader v1.2.0 in QEMU. A specially crafted command line argument can lead to a limited-shell escape and elevated capabilities. An attacker can authenticate with hard-coded credentials and execute unblocke...

CVE-2023-40146

CVE-2023-40146 is a privilege escalation in Peplink Smart Reader v1.2.0 (QEMU) where a specially crafted argument to /bin/login can trigger a limited-shell escape and elevated capabilities. An attacker can authenticate with hard-coded credentials and execute unblocked default BusyBox functionalit...

CVE-2023-39367

An OS command injection vulnerability exists in the web interface mac2name functionality of Peplink Smart Reader v1.2.0 in QEMU. A specially crafted HTTP request can lead to arbitrary command execution. An attacker can make an authenticated HTTP request to trigger this vulnerability...

CVE-2023-39367

An OS command injection vulnerability exists in the web interface mac2name functionality of Peplink Smart Reader v1.2.0 in QEMU. A specially crafted HTTP request can lead to arbitrary command execution. An attacker can make an authenticated HTTP request to trigger this vulnerability...

Peplink Smart Reader web interface /cgi-bin/debug_dump.cgi information disclosure vulnerability

Talos Vulnerability Report TALOS-2023-1863 Peplink Smart Reader web interface /cgi-bin/debugdump.cgi information disclosure vulnerability April 17, 2024 CVE Number CVE-2023-43491 SUMMARY An information disclosure vulnerability exists in the web interface /cgi-bin/debugdump.cgi functionality of...

Peplink Smart Reader /bin/login privilege escalation vulnerability

Talos Vulnerability Report TALOS-2023-1868 Peplink Smart Reader /bin/login privilege escalation vulnerability April 17, 2024 CVE Number CVE-2023-40146 SUMMARY A privilege escalation vulnerability exists in the /bin/login functionality of Peplink Smart Reader v1.2.0 in QEMU. A specially crafted...

Peplink Smart Reader 访问控制错误漏洞

Peplink Smart Reader is a smart reader from Peplink Inc. It is used for employee time and attendance. An access control error vulnerability exists in Peplink Smart Reader v1.2.0, which stems from the presence of an information disclosure vulnerability that could lead to the disclosure of sensitiv...

Peplink Smart Reader web interface mac2name OS command injection vulnerability

Talos Vulnerability Report TALOS-2023-1867 Peplink Smart Reader web interface mac2name OS command injection vulnerability April 17, 2024 CVE Number CVE-2023-39367 SUMMARY An OS command injection vulnerability exists in the web interface mac2name functionality of Peplink Smart Reader v1.2.0 in QEM...

Peplink Smart Reader web interface /cgi-bin/download_config.cgi information disclosure vulnerability

Talos Vulnerability Report TALOS-2023-1865 Peplink Smart Reader web interface /cgi-bin/downloadconfig.cgi information disclosure vulnerability April 17, 2024 CVE Number CVE-2023-45209 SUMMARY An information disclosure vulnerability exists in the web interface /cgi-bin/downloadconfig.cgi...

Peplink Smart Reader web interface /cgi-bin/upload_config.cgi data integrity vulnerability

Talos Vulnerability Report TALOS-2023-1866 Peplink Smart Reader web interface /cgi-bin/uploadconfig.cgi data integrity vulnerability April 17, 2024 CVE Number CVE-2023-45744 SUMMARY A data integrity vulnerability exists in the web interface /cgi-bin/uploadconfig.cgi functionality of Peplink Smart...

Peplink Smart Reader 访问控制错误漏洞

Peplink Smart Reader is a smart reader from Peplink Inc. It is used for employee time and attendance. An access control error vulnerability exists in Peplink Smart Reader v1.2.0, which stems from the presence of an information disclosure vulnerability that could lead to the disclosure of sensitiv...

PT-2024-12857 · Peplink · Peplink Smart Reader

Name of the Vulnerable Software and Affected Versions: Peplink Smart Reader version 1.2.0 Description: A privilege escalation issue exists in the /bin/login functionality. A specially crafted command line argument can lead to a limited-shell escape and elevated capabilities. An attacker can...

Peplink Smart Reader 操作系统命令注入漏洞

Peplink Smart Reader is a smart reader from Peplink Inc. It is used for employee time and attendance. An operating system command injection vulnerability exists in Peplink Smart Reader v1.2.0, which stems from the presence of an operating system command injection vulnerability that could lead to...

Peplink Smart Reader 信任管理问题漏洞

Peplink Smart Reader is a smart card reader from Peplink Inc. It is used for employee time and attendance. A command injection vulnerability exists in Peplink Smart Reader v1.2.0, which stems from the presence of an elevation-of-privilege vulnerability, where an attacker can cause limited shell...

Peplink Smart Reader 访问控制错误漏洞

Peplink Smart Reader is a smart reader from Peplink Inc. It is used for employee time and attendance. An access control error vulnerability exists in Peplink Smart Reader version v1.2.0, which stems from the presence of a data integrity vulnerability that could lead to configuration modifications...

PT-2024-13229 · Peplink · Peplink Smart Reader

Name of the Vulnerable Software and Affected Versions: Peplink Smart Reader version 1.2.0 Description: An information disclosure vulnerability exists in the web interface functionality of the /cgi-bin/download config.cgi endpoint. A specially crafted HTTP request can lead to a disclosure of...

WordPress WP Smart Import plugin <= 1.0.7 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by Majed Refaea Patchstack Alliance in WordPress Plugin WP Smart Import versions = 1.0.7...

Crickets from Chirp Systems in Smart Lock Key Leak

The U.S. government is warning that "smart locks" securing entry to an estimated 50,000 dwellings nationwide contain hard-coded credentials that can be used to remotely open any of the locks. The locks maker Chirp Systems remains unresponsive, even though it was first notified about the critical...

WordPress Smart Forms plugin < 2.6.94 - Subscriber+ Edit Entries via Broken Access Control vulnerability

Subscriber+ Edit Entries via Broken Access Control vulnerability discovered by Amir Hossein Fallahi in WordPress Plugin Smart Forms versions 2.6.94...

WordPress Smart Forms plugin < 2.6.94 - Edit Entries via CSRF vulnerability

Edit Entries via CSRF vulnerability discovered by Amir Hossein Fallahi in WordPress Plugin Smart Forms versions 2.6.94...