CVE-2023-50920

12.01.2024, 08:15

An issue was discovered on GL.iNet devices before version 4.5.0. They assign the same session ID after each user reboot, allowing attackers to share session identifiers between different sessions and bypass authentication or access control measures. Attackers can impersonate legitimate users or perform unauthorized actions. This affects A1300 4.4.6, AX1800 4.4.6, AXT1800 4.4.6, MT3000 4.4.6, MT2500 4.4.6, MT6000 4.5.0, MT1300 4.3.7, MT300N-V2 4.3.7, AR750S 4.3.7, AR750 4.3.7, AR300M 4.3.7, and B1300 4.3.7.

Provider	Type	Base Score	Atk. Vector	Atk. Complexity	Priv. Required	Vector
NIST	NIST	5.5 MEDIUM	LOCAL	LOW	LOW	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
mitre	CNA	---				---
CVE	ADP	---				---
CISA-ADP	ADP	---				---

Base Score

CVSS 3.x

EPSS Score

Percentile: Unknown

Vendor	Product	Version
gl-inet	gl-ax1800_firmware	4.3.7
gl-inet	gl-ax1800_firmware	4.4.6
gl-inet	gl-axt1800_firmware	4.3.7
gl-inet	gl-axt1800_firmware	4.4.6
gl-inet	gl-mt3000_firmware	4.3.7
gl-inet	gl-mt3000_firmware	4.4.6
gl-inet	gl-mt2500_firmware	4.3.7
gl-inet	gl-mt2500_firmware	4.4.6
gl-inet	gl-mt6000_firmware	4.3.7
gl-inet	gl-mt6000_firmware	4.4.6
gl-inet	gl-mt1300_firmware	4.3.7
gl-inet	gl-mt1300_firmware	4.4.6
gl-inet	gl-mt300n-v2_firmware	4.3.7
gl-inet	gl-mt300n-v2_firmware	4.4.6
gl-inet	gl-ar750s_firmware	4.3.7
gl-inet	gl-ar750s_firmware	4.4.6
gl-inet	gl-ar750_firmware	4.3.7
gl-inet	gl-ar750_firmware	4.4.6
gl-inet	gl-ar300m_firmware	4.3.7
gl-inet	gl-ar300m_firmware	4.4.6
gl-inet	gl-b1300_firmware	4.3.7
gl-inet	gl-b1300_firmware	4.4.6
gl-inet	gl-a1300_firmware	4.3.7
gl-inet	gl-a1300_firmware	4.4.6

𝑥

= Vulnerable software versions

Known Exploits!

Common Weakness Enumeration

CWE-384 - Session Fixation
Authenticating a user, or otherwise establishing a new user session, without invalidating any existing session identifier gives an attacker the opportunity to steal authenticated sessions.

References

https://github.com/gl-inet/CVE-issues/blob/main/4.0.0/Authentication-bypass-seesion-ID.md