CVE-2023-33621

MEDIUM

5.9

Beschreibung

GL.iNET GL-AR750S-Ext firmware v3.215 inserts the admin authentication token into a GET request when the OpenVPN Server config file is downloaded. The token is then left in the browser history or access logs, potentially allowing attackers to bypass authentication via session replay.

CVE Details

CVSS v3.1 Bewertung5.9

SchweregradMEDIUM

CVSS VektorCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

AngriffsvektorNETWORK

KomplexitatHIGH

Erforderliche PrivilegienNONE

BenutzerinteraktionNONE

Veroffentlicht6/13/2023

Zuletzt geandert11/21/2024

Quellenvd

Honeypot-Sichtungen0

Betroffene Produkte

gl-inet:gl-ar750sgl-inet:gl-ar750s_firmware

Schwachen (CWE)

CWE-294

Referenzen

http://gl-ar750s-ext.com(cve@mitre.org)

http://glinet.com(cve@mitre.org)

https://justinapplegate.me/2023/glinet-CVE-2023-33621/(cve@mitre.org)

http://gl-ar750s-ext.com(af854a3a-2127-422b-91ae-364da2661108)

http://glinet.com(af854a3a-2127-422b-91ae-364da2661108)

https://justinapplegate.me/2023/glinet-CVE-2023-33621/(af854a3a-2127-422b-91ae-364da2661108)

IOC Korrelationen

Keine Korrelationen erfasst

This product uses data from the NVD API but is not endorsed or certified by the NVD.