CVE-2023-45744 is a high severity improper access control flaw in the web interface of Peplink Smart Reader 1.2.0, scored 8.3. A crafted HTTP request can change the device's configuration. Peplink fixed it in firmware 1.2.1, so upgrade. Check the firmware version in the device web interface.
What's affected
Cisco Talos, in report TALOS-2023-1866, lists Peplink Smart Reader v1.2.0 as the confirmed vulnerable version. Peplink's security advisory, which covers five CVEs including this one, says the issue is fixed in firmware 1.2.1 (build 1964). Talos dates the vendor patch to 2024-04-17, the same day as public release.
The score is 8.3, High, with the vector CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:H/A:H. The record, Talos and the advisory agree on the score. The record's description says the request can be made without authentication, while the vector marks user interaction as required. Both are in the record.
The affected function is the upload_config.cgi handler in the web interface.
How to check if you're exposed
Log in to the Smart Reader's web interface and read the firmware version on the status or system page. Version 1.2.0 is affected. Version 1.2.1 or later is fixed.
Check also whether the management interface is reachable from untrusted networks. Peplink's advisory lists only the firmware upgrade as the remedy, so limiting access is a sensible extra step, not an official workaround.
What to do now
- Identify Peplink Smart Reader devices and check their firmware versions.
- Upgrade any 1.2.0 device to firmware 1.2.1 or later.
- Verify the version after the upgrade and archive the old configuration.
- Review the device's configuration for changes you did not make.
- Keep the web interface on a management network, not on the open internet.
Why it matters
The weakness is improper access control, CWE-284. The configuration upload handler in the web interface does not enforce the checks it should, so a crafted request can alter the device's settings. Talos classes the effect as a data integrity problem.
A changed configuration on a network device can redirect traffic or open access, so integrity flaws in management interfaces deserve more attention than a medium sounding description suggests.
The CVE is not on the CISA Known Exploited Vulnerabilities list, and neither Talos nor Peplink reports exploitation.
Safeguard's free in-browser dependency scan at gold.safeguard.sh/scan reads the manifests and lockfiles of software projects. It will not see firmware or device images, so for this issue the asset inventory and the vendor advisory are your main tools.
Quick check
Which firmware fixes it?
Version 1.2.1 (build 1964), according to Peplink's advisory.
Do I need to be logged in to be attacked?
The record's description says the request is unauthenticated. The vector also notes that a user action is needed.
Sources
- Cisco Talos report TALOS-2023-1866
- Peplink security advisory for Smart Reader firmware 1.2.0
- NVD record data for CVE-2023-45744
Last reviewed: 19 October 2026.
