CVE-2023-50922

An issue was discovered on GL.iNet devices through 4.5.0

High · published January 3, 2024

CVSS v3.1
7.2
EPSS
1%
Percentile
58.1
In the wild
Unconfirmed
What it is

An issue was discovered on GL.iNet devices through 4.5.0. Attackers who are able to steal the AdminToken cookie can execute arbitrary code by uploading a crontab-formatted file to a specific directory and waiting for its execution. This affects A1300 4.4.6, AX1800 4.4.6, AXT1800 4.4.6, MT3000 4.4.6, MT2500 4.4.6, MT6000 4.5.0, MT1300 4.3.7, MT300N-V2 4.3.7, AR750S 4.3.7, AR750 4.3.7, AR300M 4.3.7, and B1300 4.3.7.

The record
Technical detail
CVSS v3.1
7.2 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00861 · 58.1th percentile
Published
2024-01-03T00:00Z
EPSS history
Timeline
  • 03 JAN 00:00Z
    An issue was discovered on GL.iNet devices through 4.5.0
    cvelistv5