CVE-2023-43491 is a medium severity (CVSS 5.3) information disclosure flaw in the web interface of Peplink Smart Reader firmware 1.2.0, in the debug_dump.cgi function. An unauthenticated HTTP request can leak sensitive information. Peplink says firmware 1.2.1 fixes it, so update and keep the web interface off untrusted networks.
What's affected
The record lists Peplink Smart Reader firmware 1.2.0 as affected. It describes an information disclosure vulnerability in the web interface's /cgi-bin/debug_dump.cgi functionality, triggered by a specially crafted HTTP request from an unauthenticated attacker. The record adds the note "in QEMU", an emulator, so the observation was made with the firmware running in emulation.
Peplink's advisory, posted April 15, 2024 on its community forum, covers five CVEs for Smart Reader 1.2.0: CVE-2023-43491, CVE-2023-45209, CVE-2023-39367, CVE-2023-45744 and CVE-2023-40146. The advisory says the issues were found by a security research lab and have been fixed in firmware 1.2.1. The thread shows a later post dated October 9, 2025 announcing that release.
The weakness is CWE-284, improper access control. The record's CVSS is 5.3, medium, with a low confidentiality impact and no integrity or availability impact.
How to check if you're exposed
Read the firmware version from the device's web interface and compare it with 1.2.1. Also check who can reach the interface:
curl -sI http://192.0.2.20/ | head -n 5
Use your device's address in place of the documentation address shown. A response from outside your management network means the interface is exposed more widely than it should be. Do not request the debug function itself on production devices.
What to do now
- Update Peplink Smart Reader devices to firmware 1.2.1 or later.
- Restrict the web interface to a management network or VPN.
- Do not expose the device's web port to the internet.
- Review other Smart Reader findings in the same advisory, since four more CVEs share it.
- Rotate any credentials or keys that the device may hold if it was exposed before the update.
- Add the firmware version to your asset inventory so future advisories are easy to match.
Why it matters
A debug function reachable without login is a common design mistake in embedded devices. Debug output can include configuration, file paths or credentials. The record's class, CWE-284, covers a missing access check on a function that should have one.
On its own the severity is medium: the impact is limited to confidentiality, and the record rates it low. But leaked information is often the first step of a longer chain, and the same advisory lists a command injection flaw and a hard coded credential issue for the same firmware. A device that discloses details to anyone helps those other bugs. The KEV flag is false.
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
Are the other four CVEs fixed in the same firmware?
Peplink's advisory says the issues it lists were fixed in firmware 1.2.1.
Sources
- Peplink Security Advisory: Smart Reader Firmware 1.2.0
- Talos report TALOS-2023-1863 (referenced in the record; content did not load when fetched)
- NetApp advisory NTAP-20240828-0005 (referenced in the record; content did not load when fetched)
Last reviewed: 19 October 2026.
