Privilege Escalation Vulnerability in Peplink Smart Reader v1.2.0

CVE-2023-40146

What is CVE-2023-40146?

A privilege escalation vulnerability has been identified in the /bin/login functionality of Peplink Smart Reader version 1.2.0, specifically within a QEMU environment. This vulnerability allows an attacker to exploit a specially crafted command line argument to gain a limited shell escape, subsequently leading to the execution of unblocked default busybox functionality. By leveraging hard-coded credentials, an attacker can authenticate and trigger this vulnerability, effectively escalating their privileges within the system. Organizations utilizing this version of the product are advised to implement security measures immediately.

References