CVSS 3.1
7.2 highCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:HCVE-2023-50922
High (7.2) in gl-inet. EPSS 0.9% chance of exploitation in the next 30 days.
An issue was discovered on GL.iNet devices through 4.5.0. Attackers who are able to steal the AdminToken cookie can execute arbitrary code by uploading a crontab-formatted file to a specific directory and waiting for its execution. This affects A1300 4.4.6, AX1800 4.4.6, AXT1800 4.4.6, MT3000 4.4.6, MT2500 4.4.6, MT6000 4.5.0, MT1300 4.3.7, MT300N-V2 4.3.7, AR750S 4.3.7, AR750 4.3.7, AR300M 4.3.7, and B1300 4.3.7.
Severity
- EPSS
- 0.9% chance of exploitation in the next 30 days; higher than 58% of CVEs (scores of 2026-10-31)
- CWE
- CWE-434
- Published
- Modified
- Record from
- the NVD, synced
Affected
- gl-inet:gl-a1300_firmware
- gl-inet:gl-ar300m_firmware
- gl-inet:gl-ar750_firmware
- gl-inet:gl-ar750s_firmware
- gl-inet:gl-ax1800_firmware
- gl-inet:gl-axt1800_firmware
- gl-inet:gl-b1300_firmware
- gl-inet:gl-mt1300_firmware
- gl-inet:gl-mt2500_firmware
- gl-inet:gl-mt3000_firmware
- gl-inet:gl-mt300n-v2_firmware
- gl-inet:gl-mt6000_firmware