Bypassing Access Control via Crafted Cookie in RE160 Firmware
CVE-2023-38946

8.8HIGH

Key Information:

Vendor

Multilaser

Status
Re160 Firmware
Vendor
CVE Published:
6 March 2024

What is CVE-2023-38946?

A vulnerability in the firmware of the Multilaser RE160 router allows attackers to bypass access controls. By supplying a specially crafted cookie, an attacker can gain unauthorized access to the application's functions, posing a significant risk to the security of any network utilizing this router. Users should update to the latest firmware versions to mitigate this risk.

References

http://seclists.org/fulldisclosure/2024/Mar/2
mailing-list

CVSS V3.1

Score:
8.8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

.
CVE-2023-38946 : Bypassing Access Control via Crafted Cookie in RE160 Firmware