CVE-2023-45209 is a medium severity information disclosure flaw in the Peplink Smart Reader web interface, scored 5.3 by NVD. Peplink says firmware 1.2.1 fixes it. Upgrade from 1.2.0, keep the web interface off the internet, and rotate any secrets stored in the device configuration.
What's affected
The NVD record lists Peplink Smart Reader firmware 1.2.0 as affected, noting the test was done in QEMU. The Peplink advisory, posted on 15 April 2024, covers five CVEs in Smart Reader firmware 1.2.0 and says the fix is in firmware version 1.2.1. The NVD record was published on 2024-04-17.
NVD scores the flaw 5.3, Medium, with the vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N. The Peplink post does not give its own score.
The record says an unauthenticated HTTP request to the cgi script download_config.cgi can lead to disclosure of sensitive information. The Talos report TALOS-2023-1865 is linked from the record, but its page was blocked when I fetched it, so I rely on the NVD text and the Peplink post.
The Peplink advisory covers four sibling issues: CVE-2023-43491 (another information disclosure), CVE-2023-39367 (command injection), CVE-2023-45744 and CVE-2023-40146. Upgrading to 1.2.1 is the single action for all of them.
Weakness class: CWE-284 (improper access control).
How to check if you're exposed
Sign in to the Smart Reader admin interface and read the firmware version from the status or about page. Version 1.2.0 is the one named in the record. Version 1.2.1 or later is the fixed release according to Peplink.
Then check reachability. From a machine outside your network, confirm that the device web interface does not answer. If the device sits behind a router with port forwarding, review those rules.
What to do now
- Inventory Peplink Smart Reader devices and record the firmware of each.
- Download firmware 1.2.1 or later from Peplink and install it following their instructions.
- Remove any internet exposure of the web interface and restrict it to a management network.
- After updating, rotate credentials and any secrets that may be stored in the device configuration, since the flaw concerns a configuration download.
- Read the Peplink advisory for the four related CVEs and confirm the update covers them.
Why it matters
The record maps the weakness to improper access control, tracked as CWE-284. A configuration download script answers a request from someone who has not logged in. Configuration files can hold network details and stored credentials, which is why even a medium score deserves quick action on an edge device.
The score is limited to low confidentiality impact. The practical impact depends on what your configuration contains. CVE-2023-45209 is not on the CISA Known Exploited Vulnerabilities list, and none of the pages I read says it has been exploited in the wild. That is a statement about what is recorded, not a reason to delay. Because this is device firmware, Safeguard's free in-browser dependency scan will not list it, so track it in your hardware inventory.
Quick check
Which firmware fixes CVE-2023-45209?
Peplink says Smart Reader firmware 1.2.1 fixes it. The record lists 1.2.0 as affected.
Does the attacker need a login?
No. The record says an unauthenticated HTTP request can trigger it.
Sources
Last reviewed: 19 October 2026.
