CVE-2023-45744

A data integrity vulnerability exists in the web interface /cgi-bin/upload_config.cgi functionality of Peplink Smart Reader v1.2.0 (in QEMU). A specially crafted HTTP request can lead to configuration modification. An attacker can make an unauthenticated HTTP request to trigger this vulnerability.

• CWE-284

• https://forum.peplink.com/t/peplink-security-advisory-smart-reader-firmware-1-2-0-cve-2023-43491-cve-2023-45209-cve-2023-39367-cve-2023-45744-cve-2023-40146/47256Vendor Advisory
• https://talosintelligence.com/vulnerability_reports/TALOS-2023-1866Exploit, Third Party Advisory
• https://forum.peplink.com/t/peplink-security-advisory-smart-reader-firmware-1-2-0-cve-2023-43491-cve-2023-45209-cve-2023-39367-cve-2023-45744-cve-2023-40146/47256Vendor Advisory
• https://security.netapp.com/advisory/ntap-20240828-0006/Third Party Advisory
• https://talosintelligence.com/vulnerability_reports/TALOS-2023-1866Exploit, Third Party Advisory
• https://www.talosintelligence.com/vulnerability_reports/TALOS-2023-1866

Published

Apr 17, 2024

Last Modified

Jun 17, 2026

Status

Modified

• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2023-45738Rejected reason: This is unused.
• CVE-2023-4574When creating a callback over IPC for showing the Color Pick…6.5
• CVE-2023-45740Stored cross-site scripting vulnerability when processing pr…5.4
• CVE-2023-45741VR-S1000 firmware Ver. 2.37 and earlier allows an attacker w…6.8
• CVE-2023-45742An integer overflow vulnerability exists in the boa updateCo…7.2
• CVE-2023-45743Uncontrolled search path in some Intel(R) DSA software unins…7.3
• CVE-2023-45745Improper input validation in some Intel(R) TDX module softwa…8.2
• CVE-2023-45746Cross-site scripting vulnerability in Movable Type series al…5.4
• CVE-2023-45747Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerabili…4.8
• CVE-2023-45748Cross-Site Request Forgery (CSRF) vulnerability in MailMunch…8.8
• CVE-2023-45749Cross-Site Request Forgery (CSRF) vulnerability in Alexey Go…8.8
• CVE-2023-4575When creating a callback over IPC for showing the File Picke…6.5