Peplink vulnerabilities

CVEs per yearBy the year they were published

1. 20236
2. 20245
3. 20261

Newest CVEs

• CVE-2026-57920

  Peplink InControl 2 through 2.14.2 before 2026-06-03 allows use of a semicolon to bypass access-control rules for certain /rest/o/{orgId} endpoints.

  Peplink · InControl

  High7.7
• CVE-2023-43491

  An information disclosure vulnerability exists in the web interface /cgi-bin/debug_dump.cgi functionality of Peplink Smart Reader v1.2.0 (in QEMU). A specially…

  Peplink · Smart Reader

  Medium5.3
• CVE-2023-45209

  An information disclosure vulnerability exists in the web interface /cgi-bin/download_config.cgi functionality of Peplink Smart Reader v1.2.0 (in QEMU). A…

  Peplink · Smart Reader

  Medium5.3
• CVE-2023-45744

  A data integrity vulnerability exists in the web interface /cgi-bin/upload_config.cgi functionality of Peplink Smart Reader v1.2.0 (in QEMU). A specially…

  Peplink · Smart Reader

  High8.3
• CVE-2023-39367

  An OS command injection vulnerability exists in the web interface mac2name functionality of Peplink Smart Reader v1.2.0 (in QEMU). A specially crafted HTTP…

  Peplink · Smart Reader

  Critical9.1
• CVE-2023-40146

  A privilege escalation vulnerability exists in the /bin/login functionality of Peplink Smart Reader v1.2.0 (in QEMU). A specially crafted command line argument…

  Peplink · Smart Reader

  Medium6.8
• CVE-2023-34356

  An OS command injection vulnerability exists in the data.cgi xfer_dns functionality of peplink Surf SOHO HW1 v6.3.5 (in QEMU). A specially crafted HTTP request…

  Peplink · Surf SOHO HW1

  High7.2
• CVE-2023-28381

  An OS command injection vulnerability exists in the admin.cgi MVPN_trial_init functionality of peplink Surf SOHO HW1 v6.3.5 (in QEMU). A specially crafted HTTP…

  Peplink · Surf SOHO HW1

  High7.2
• CVE-2023-27380

  An OS command injection vulnerability exists in the admin.cgi USSD_send functionality of peplink Surf SOHO HW1 v6.3.5 (in QEMU). A specially crafted HTTP…

  Peplink · Surf SOHO HW1

  High7.2
• CVE-2023-34354

  A stored cross-site scripting (XSS) vulnerability exists in the upload_brand.cgi functionality of peplink Surf SOHO HW1 v6.3.5 (in QEMU). A specially crafted…

  Peplink · Surf SOHO HW1

  Low3.4