CVE-2023-45744
📋 TL;DR
An unauthenticated data integrity vulnerability in Peplink Smart Reader v1.2.0 allows attackers to modify device configuration via specially crafted HTTP requests to the /cgi-bin/upload_config.cgi endpoint. This affects all users running the vulnerable firmware version in QEMU environments. Attackers can exploit this without credentials to alter system settings.
💻 Affected Systems
- Peplink Smart Reader
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete device compromise allowing configuration changes that could enable persistent backdoors, network redirection, or disable security controls.
Likely Case
Unauthorized configuration changes leading to service disruption, data interception, or lateral movement within the network.
If Mitigated
Limited impact with proper network segmentation and access controls preventing external exploitation.
🎯 Exploit Status
Talos Intelligence has published detailed vulnerability reports with technical analysis
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Firmware versions after 1.2.0
Restart Required: Yes
Instructions:
1. Download latest firmware from Peplink support portal. 2. Backup current configuration. 3. Upload and install new firmware via web interface. 4. Reboot device. 5. Restore configuration if needed.
🔧 Temporary Workarounds
Network Access Restriction
linuxBlock external access to the web interface using firewall rules
iptables -A INPUT -p tcp --dport 80 -j DROP
iptables -A INPUT -p tcp --dport 443 -j DROP
URL Filtering
linuxBlock access to the vulnerable CGI endpoint
iptables -A INPUT -m string --string "/cgi-bin/upload_config.cgi" --algo bm -j DROP
🧯 If You Can't Patch
- Isolate affected devices in separate VLAN with strict access controls
- Implement web application firewall (WAF) rules to block malicious upload_config.cgi requests
🔍 How to Verify
Check if Vulnerable:
Check firmware version in web interface or via SSH: cat /etc/versionCheck Version:
cat /etc/version || grep -i version /etc/*releaseVerify Fix Applied:
Verify firmware version is greater than 1.2.0 and test upload_config.cgi endpoint returns proper authentication error📡 Detection & Monitoring
Log Indicators:
- HTTP POST requests to /cgi-bin/upload_config.cgi without authentication
- Configuration file modification timestamps
Network Indicators:
- Unusual HTTP traffic to port 80/443 with upload_config.cgi in URI
- Configuration uploads from unauthorized IPs
SIEM Query:
source="web_logs" AND uri="/cgi-bin/upload_config.cgi" AND NOT user_agent="*Peplink*"🔗 References
- https://forum.peplink.com/t/peplink-security-advisory-smart-reader-firmware-1-2-0-cve-2023-43491-cve-2023-45209-cve-2023-39367-cve-2023-45744-cve-2023-40146/47256
- https://talosintelligence.com/vulnerability_reports/TALOS-2023-1866
- https://forum.peplink.com/t/peplink-security-advisory-smart-reader-firmware-1-2-0-cve-2023-43491-cve-2023-45209-cve-2023-39367-cve-2023-45744-cve-2023-40146/47256
- https://security.netapp.com/advisory/ntap-20240828-0006/
- https://talosintelligence.com/vulnerability_reports/TALOS-2023-1866
- https://www.talosintelligence.com/vulnerability_reports/TALOS-2023-1866
