Description
Peplink Smart Reader是Peplink公司的一个智能读卡器，Peplink Smart Reader存在command injection漏洞，此漏洞是由于api.cgi接口对用户的请求验证不当导致的。
Peplink Smart Reader CVE-2023-39367 命令注入漏洞
PoC
None yet. Search at https://trap.biu.life/?ref=rssReferences
https://forum.peplink.com/t/peplink-security-advisory-smart-reader-firmware-1-2-0-cve-2023-43491-cve-2023-45209-cve-2023-39367-cve-2023-45744-cve-2023-40146/47256
https://nvd.nist.gov/vuln/detail/CVE-2023-39367
https://github.com/advisories/GHSA-r4rf-j49f-c6q2
https://www.talosintelligence.com/vulnerability_reports/TALOS-2023-1867
https://avd.aliyun.com/product?prod=smart_reader_firmware&page=-6
https://cve.circl.lu/vuln/gsd-2023-39367
https://app.opencve.io/cve/?vendor=peplink
https://sara-open.sirp.io/cve/CVE-2023-39367