Vulnerabilities in employee management system could lead to remote code execution, login credential theft

Summary: Cisco Talos disclosed more than a dozen vulnerabilities over three weeks, including five in the Peplink Smart Reader, an internet-connected device employees use to check in and out of shifts and which can also control building and public transportation access. Two information disclosure flaws, TALOS-2023-1863 (CVE-2023-43491) and TALOS-2023-1865 (CVE-2023-45209), are triggered by a specially crafted HTTP message and can expose the active administrator's username and MD5-hashed password, with the latter also potentially revealing wireless network credentials, network configuration details and SNMP configuration details.
Bottom line: The most serious Smart Reader issue, TALOS-2023-1867 (CVE-2023-39367), carries a 9.1 CVSS score and lets an authenticated attacker run arbitrary commands with root privileges - on a device that also gates physical access to buildings and public transportation.

Read the original at Cisco Talos ↗

Topics: Vulnerabilities & Patching
Mentions: CVE-2023-39367 CVE-2023-40146 CVE-2023-43491 CVE-2023-45209 CVE-2023-45744 CVE-2023-51391 CVE-2024-28130
Related: Whatsup Gold, Observium and Offis vulnerabilities Cyber Risks ·
Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026
U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026