CVE-2023-39367 is a critical severity (CVSS 9.1) OS command injection in the web interface of Peplink Smart Reader firmware 1.2.0. An authenticated HTTP request to the mac2name function can lead to arbitrary command execution. Peplink fixed it in firmware 1.2.1.
What's affected
The NVD record names the Peplink Smart Reader hardware and firmware 1.2.0. The record scores it 9.1 (Critical) with the vector CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H. The vector needs high privileges, so an administrator level login is required, and the scope is changed.
Peplink's own advisory, dated 15 April 2024, covers five Smart Reader flaws found by an outside research lab, in firmware 1.2.0: CVE-2023-43491, CVE-2023-45209, CVE-2023-39367, CVE-2023-45744 and CVE-2023-40146. It says all of them are fixed in firmware 1.2.1.
The weakness class is CWE-78 (improper neutralization of special elements used in an OS command). The Talos report is listed as a reference as well, though it blocked automated access. The record does not mark this CVE as being in the CISA Known Exploited Vulnerabilities catalog, and nothing we could read says it is exploited in the wild.
How to check if you're exposed
Open the web administration interface of each Smart Reader and read the firmware version. If it shows 1.2.0, it is affected. Version 1.2.1 contains the fixes.
Also check where the web interface is reachable from. It should sit on a management network and not be open to the internet. The advisory describes the flaw as reachable through an authenticated HTTP request, so a login is the first barrier.
What to do now
- List every Peplink Smart Reader and the firmware version it runs.
- Download firmware 1.2.1 from the link in the Peplink advisory and update each device. Peplink says the five flaws in the advisory are fixed in that release.
- Restrict the web interface to a management network or a VPN, and remove any port forward that exposes it.
- Change administrator passwords and remove any default or shared credentials. The advisory also lists a hard coded credentials issue, CVE-2023-40146, as part of the same release.
- Review device logs for unexpected logins and configuration changes.
Why it matters
OS command injection means a field from a web request is placed into a command run on the device. The advisory names the web interface as the entry, and the record names the mac2name function. The device runs under QEMU in the research setup, according to the record.
The score is critical because the vector rates the impact on all three of confidentiality, integrity and availability as high, with a changed scope. The need for administrator credentials lowers the real world risk, but the advisory covers a cluster of weaknesses in the same release, including information disclosure and hard coded credentials, and bugs in a cluster can be chained. That is the best reason to move to 1.2.1 and not patch only one item.
Quick check
Do I need to log in to use this?
Yes. The record says the attacker makes an authenticated HTTP request, and the vector needs high privileges.
Which firmware fixes it?
Peplink says firmware 1.2.1 fixes the Smart Reader flaws listed in its 15 April 2024 advisory.
Sources
- Peplink Security Advisory: Smart Reader Firmware 1.2.0
- Talos report TALOS-2023-1867 (listed in the record; blocked automated access)
- Safeguard Gold entry for CVE-2023-39367
Last reviewed: 19 October 2026.
