PT-2024-14008 · Gl.Inet · Gl.Inet

Published 2024-01-12 · Updated 2024-01-19 · CVE-2023-50920

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Medium

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions GL.iNet devices versions prior to 4.5.0

Description An issue was discovered where GL.iNet devices assign the same session ID after each user reboot, allowing attackers to share session identifiers between different sessions and bypass authentication or access control measures. Attackers can impersonate legitimate users or perform unauthorized actions.

Recommendations For versions prior to 4.5.0, update to version 4.5.0 or later to resolve the issue. As a temporary workaround, consider implementing additional authentication measures to minimize the risk of exploitation. Restrict access to sensitive areas of the device to minimize the risk of unauthorized actions.

Exploit

Fix

Session Fixation

Weakness Enumeration

CWE-384

Related Identifiers

CVE-2023-50920

Affected Products

Gl.Inet

References · 5

• 🔥 https://github.com/gl-inet/CVE-issues/blob/main/4.0.0/Authentication-bypass-seesion-ID.md · Exploit
• https://osv.dev/vulnerability/CVE-2023-50920 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-50920 · Security Note
• https://t.me/cvenotify/67966 · Telegram Post
• https://twitter.com/VulmonFeeds/status/1745769450136047628 · Twitter Post