CVE-2023-40146 is a medium severity (CVSS 6.8) privilege escalation in the login function of Peplink Smart Reader firmware 1.2.0. Hard-coded credentials and a limited shell can be escaped for elevated capabilities. Peplink says firmware 1.2.1 fixes it.
What's affected
The record names Peplink Smart Reader firmware 1.2.0 and the Smart Reader hardware. It scores the issue 6.8 (Medium) with the vector CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. The AV:P part means physical access to the device is part of the scenario, which is why the score is not higher.
The weaknesses are CWE-77 (command injection, in the sense of an argument that changes what a command does) and CWE-798 (use of hard-coded credentials).
Peplink's own advisory, published on 2024-04-17, says the problem was found in firmware 1.2.0 and is fixed in firmware 1.2.1. The same advisory covers four other CVEs in the same firmware: CVE-2023-43491, CVE-2023-45209, CVE-2023-39367 and CVE-2023-45744. Two of those are described as unauthenticated information disclosure through the web interface and one as command injection, so the 1.2.1 update matters for more than this single entry.
The Talos report named in the record was blocked to our fetch, so the technical detail here follows the Peplink advisory and the NVD text only.
How to check if you're exposed
Find the Smart Reader units you run and read the firmware version from the device. Peplink's advisory is the authority on where that is shown for your model, so use its steps or your Peplink support channel if you are unsure.
A unit on 1.2.0 is in scope. A unit on 1.2.1 or later has the fix, according to the advisory. If you cannot confirm the version, treat the device as exposed until you can.
Also ask who can reach the unit physically and who holds credentials for it. The attack described in the record starts with authenticating using credentials that are built into the firmware, so changing the administrator password does not remove the risk. Only the firmware update does.
What to do now
- List every Peplink Smart Reader in your estate and note its firmware version.
- Upgrade units on 1.2.0 to firmware 1.2.1 using the download link in the Peplink advisory.
- Review the other four CVEs in the advisory and confirm each unit is on a build that addresses them.
- Limit physical access to the devices, and place them on a network segment with only the traffic they need.
- Add the device to your asset inventory with the firmware version, so the next advisory is a lookup rather than a hunt.
Why it matters
Hard-coded credentials are a design flaw, not a mistake an operator can configure away. Anyone who learns them, from a firmware image for example, can sign in on every device running that firmware. The record says the attacker authenticates with those credentials and then uses default busybox functionality that was not blocked.
The second half of the chain is a restricted shell that is not restricted enough. Embedded devices often rely on a locked down command line as a safety layer, and a single unblocked utility is enough to step out of it. That is why the advisory pairs the shell escape with the credentials.
Quick check
Does changing the device password fix this?
No. The record describes hard-coded credentials, which belong to the firmware. Peplink's remedy is the firmware 1.2.1 update.
Is a physical attacker really a concern for a device like this?
The vector says physical access (AV:P), so the score is lower than a network bug. That still matters for devices placed in shared or public spaces. If the device is in a locked room the risk is smaller, but the update is still the clean answer.
Sources
Last reviewed: 19 October 2026.
