CVE-2023-40146: Command Injection
First published: Wed Apr 17 2024(Updated: )
A privilege escalation vulnerability exists in the /bin/login functionality of Peplink Smart Reader v1.2.0 (in QEMU). A specially crafted command line argument can lead to a limited-shell escape and elevated capabilities. An attacker can authenticate with hard-coded credentials and execute unblocked default busybox functionality to trigger this vulnerability.
Credit: talos-cna@cisco.com
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://talosintelligence.com/vulnerability_reports/TALOS-2023-1868
- https://forum.peplink.com/t/peplink-security-advisory-smart-reader-firmware-1-2-0-cve-2023-43491-cve-2023-45209-cve-2023-39367-cve-2023-45744-cve-2023-40146/47256
- https://www.talosintelligence.com/vulnerability_reports/TALOS-2023-1868
- collector/mitre-cve
- source/MITRE
- agent/references
- agent/weakness
- agent/first-publish-date
- agent/description
- agent/type
- agent/severity
- agent/last-modified-date
- agent/author
- agent/event
- agent/tags
- collector/nvd-api
- source/NVD