CVE-2023-43491

An information disclosure vulnerability exists in the web interface /cgi-bin/debug_dump.cgi functionality of Peplink Smart Reader v1.2.0 (in QEMU). A specially crafted HTTP request can lead to a disclosure of sensitive information. An attacker can make an unauthenticated HTTP request to trigger this vulnerability.

• CWE-284

• https://forum.peplink.com/t/peplink-security-advisory-smart-reader-firmware-1-2-0-cve-2023-43491-cve-2023-45209-cve-2023-39367-cve-2023-45744-cve-2023-40146/47256Vendor Advisory
• https://talosintelligence.com/vulnerability_reports/TALOS-2023-1863Exploit, Third Party Advisory
• https://forum.peplink.com/t/peplink-security-advisory-smart-reader-firmware-1-2-0-cve-2023-43491-cve-2023-45209-cve-2023-39367-cve-2023-45744-cve-2023-40146/47256Vendor Advisory
• https://security.netapp.com/advisory/ntap-20240828-0005/Third Party Advisory
• https://talosintelligence.com/vulnerability_reports/TALOS-2023-1863Exploit, Third Party Advisory
• https://www.talosintelligence.com/vulnerability_reports/TALOS-2023-1863

Published

Apr 17, 2024

Last Modified

Jun 17, 2026

Status

Modified

• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2023-43485 When TACACS+ audit forwarding is configured on BIG-IP or BI…5.5
• CVE-2023-43487Improper access control in some Intel(R) CST before version …4.7
• CVE-2023-43488The vulnerability allows a low privileged (untrusted) applic…7.8
• CVE-2023-43489Improper access control for some Intel(R) CIP software befor…5.5
• CVE-2023-4349Use after free in Device Trust Connectors in Google Chrome p…8.8
• CVE-2023-43490Incorrect calculation in microcode keying mechanism for some…5.3
• CVE-2023-43492 In Weintek's cMT3000 HMI Web CGI device, the cgi-bi…9.8
• CVE-2023-43493SQL injection vulnerability in Item List page of Welcart e-C…4.9
• CVE-2023-43494Jenkins 2.50 through 2.423 (both inclusive), LTS 2.60.1 thro…4.3
• CVE-2023-43495Jenkins 2.423 and earlier, LTS 2.414.1 and earlier does not …5.4
• CVE-2023-43496Jenkins 2.423 and earlier, LTS 2.414.1 and earlier creates a…8.8
• CVE-2023-43497In Jenkins 2.423 and earlier, LTS 2.414.1 and earlier, proce…8.1