Authentication Bypass Vulnerability in GL.iNet Devices
CVE-2023-50920

5.5MEDIUM

Key Information:

Vendor

GL.iNet

Status
GL.iNet Devices
Vendor
CVE Published:
12 January 2024

What is CVE-2023-50920?

GL.iNet devices prior to version 4.5.0 exhibit a serious flaw where the same session ID is assigned upon user reboot. This vulnerability allows attackers to share session identifiers across different sessions, resulting in the potential for unauthorized access. Malicious actors can impersonate legitimate users, effectively bypassing authentication measures and executing unintended actions on the device. The following models are impacted: A1300, AX1800, AXT1800, MT3000, MT2500, MT6000, MT1300, MT300N-V2, AR750S, AR750, AR300M, and B1300, all with specific firmware versions.

References

https://github.com/gl-inet/CVE-issues/blob/main/4.0.0/Aut...

CVSS V3.1

Score:
5.5
Severity:
MEDIUM
Confidentiality:
None
Integrity:
High
Availability:
None
Attack Vector:
Local
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.