CVE-2023-50920
An issue was discovered on GL.iNet devices before version 4.5.0. They assign the same session ID after each user reboot, allowing attackers to share session identifiers between different sessions and bypass authentication or access control measures. Attackers can impersonate legitimate users or perform unauthorized actions. This affects A1300 4.4.6, AX1800 4.4.6, AXT1800 4.4.6, MT3000 4.4.6, MT2500 4.4.6, MT6000 4.5.0, MT1300 4.3.7, MT300N-V2 4.3.7, AR750S 4.3.7, AR750 4.3.7, AR300M 4.3.7, and B1300 4.3.7.
- Affected products
- Gl.Inet
- Gl-inet gl-ax1800 Firmware
- = 4.3.7, 4.4.6
- Fix
- Available
- CVSS 3.1
- 5.5 MEDIUM
- EPSS
- 0.2% (10th percentile)
- Weakness
- CWE-384
- NVD status
- Modified
- Published
- 2024-01-12
CVE-2023-50920 at NVD
No indexed exploits for CVE-2023-50920 yet
Our index is partial: it proves presence, never absence
No exploit for CVE-2023-50920 has been indexed yet. Our index is built from live traffic and upstream syncs, so this page can only say what it knows — not that no exploit exists.