2024-01-12 09:00:28 +00:00
{
"id" : "CVE-2023-50919" ,
"sourceIdentifier" : "cve@mitre.org" ,
"published" : "2024-01-12T08:15:43.533" ,
2024-12-08 03:06:42 +00:00
"lastModified" : "2024-11-21T08:37:31.660" ,
2024-01-24 17:00:29 +00:00
"vulnStatus" : "Modified" ,
2024-07-14 02:06:08 +00:00
"cveTags" : [ ] ,
2024-01-12 09:00:28 +00:00
"descriptions" : [
{
"lang" : "en" ,
"value" : "An issue was discovered on GL.iNet devices before version 4.5.0. There is an NGINX authentication bypass via Lua string pattern matching. This affects A1300 4.4.6, AX1800 4.4.6, AXT1800 4.4.6, MT3000 4.4.6, MT2500 4.4.6, MT6000 4.5.0, MT1300 4.3.7, MT300N-V2 4.3.7, AR750S 4.3.7, AR750 4.3.7, AR300M 4.3.7, and B1300 4.3.7."
2024-01-12 15:00:29 +00:00
} ,
{
"lang" : "es" ,
"value" : "Se descubri\u00f3 un problema en dispositivos GL.iNet anteriores a la versi\u00f3n 4.5.0. Existe una omisi\u00f3n de autenticaci\u00f3n NGINX mediante la coincidencia de patrones de cadenas Lua. Esto afecta a A1300 4.4.6, AX1800 4.4.6, AXT1800 4.4.6, MT3000 4.4.6, MT2500 4.4.6, MT6000 4.5.0, MT1300 4.3.7, MT300N-V2 4.3.7, AR750S 4.3.7, AR750 4.3.7, AR300M 4.3.7 y B1300 4.3.7."
2024-01-12 09:00:28 +00:00
}
] ,
2024-01-19 03:00:28 +00:00
"metrics" : {
"cvssMetricV31" : [
{
"source" : "nvd@nist.gov" ,
"type" : "Primary" ,
"cvssData" : {
"version" : "3.1" ,
"vectorString" : "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" ,
2024-12-08 03:06:42 +00:00
"baseScore" : 9.8 ,
"baseSeverity" : "CRITICAL" ,
2024-01-19 03:00:28 +00:00
"attackVector" : "NETWORK" ,
"attackComplexity" : "LOW" ,
"privilegesRequired" : "NONE" ,
"userInteraction" : "NONE" ,
"scope" : "UNCHANGED" ,
"confidentialityImpact" : "HIGH" ,
"integrityImpact" : "HIGH" ,
2024-12-08 03:06:42 +00:00
"availabilityImpact" : "HIGH"
2024-01-19 03:00:28 +00:00
} ,
"exploitabilityScore" : 3.9 ,
"impactScore" : 5.9
}
]
} ,
"weaknesses" : [
{
"source" : "nvd@nist.gov" ,
"type" : "Primary" ,
"description" : [
{
"lang" : "en" ,
"value" : "CWE-287"
}
]
}
] ,
"configurations" : [
{
"operator" : "AND" ,
"nodes" : [
{
"operator" : "OR" ,
"negate" : false ,
"cpeMatch" : [
{
"vulnerable" : true ,
"criteria" : "cpe:2.3:o:gl-inet:gl-ax1800_firmware:4.3.7:*:*:*:*:*:*:*" ,
"matchCriteriaId" : "9085B46F-0620-4126-9E6B-C729C49C23C4"
} ,
{
"vulnerable" : true ,
"criteria" : "cpe:2.3:o:gl-inet:gl-ax1800_firmware:4.4.6:*:*:*:*:*:*:*" ,
"matchCriteriaId" : "CC12DFE3-F634-4737-AEF7-82685634F65E"
}
]
2024-12-08 03:06:42 +00:00
} ,
2024-01-19 03:00:28 +00:00
{
"operator" : "OR" ,
"negate" : false ,
"cpeMatch" : [
{
"vulnerable" : false ,
2024-12-08 03:06:42 +00:00
"criteria" : "cpe:2.3:h:gl-inet:gl-ax1800:-:*:*:*:*:*:*:*" ,
"matchCriteriaId" : "459CA3AD-7D9A-4E72-8847-9F989232CDCD"
2024-01-19 03:00:28 +00:00
}
]
2024-12-08 03:06:42 +00:00
}
]
} ,
{
"operator" : "AND" ,
"nodes" : [
2024-01-19 03:00:28 +00:00
{
"operator" : "OR" ,
"negate" : false ,
"cpeMatch" : [
{
"vulnerable" : true ,
"criteria" : "cpe:2.3:o:gl-inet:gl-axt1800_firmware:4.3.7:*:*:*:*:*:*:*" ,
"matchCriteriaId" : "C3C99D06-8CF3-4F1F-9729-DDD871CD28D8"
} ,
{
"vulnerable" : true ,
"criteria" : "cpe:2.3:o:gl-inet:gl-axt1800_firmware:4.4.6:*:*:*:*:*:*:*" ,
"matchCriteriaId" : "2321AEF1-B475-439F-A936-581337CB5181"
}
]
2024-12-08 03:06:42 +00:00
} ,
2024-01-19 03:00:28 +00:00
{
"operator" : "OR" ,
"negate" : false ,
"cpeMatch" : [
{
"vulnerable" : false ,
2024-12-08 03:06:42 +00:00
"criteria" : "cpe:2.3:h:gl-inet:gl-axt1800:-:*:*:*:*:*:*:*" ,
"matchCriteriaId" : "49448661-9D95-4218-B2FA-73610AA5523C"
2024-01-19 03:00:28 +00:00
}
]
2024-12-08 03:06:42 +00:00
}
]
} ,
{
"operator" : "AND" ,
"nodes" : [
2024-01-19 03:00:28 +00:00
{
"operator" : "OR" ,
"negate" : false ,
"cpeMatch" : [
{
"vulnerable" : true ,
"criteria" : "cpe:2.3:o:gl-inet:gl-mt3000_firmware:4.3.7:*:*:*:*:*:*:*" ,
"matchCriteriaId" : "0E4AFE9D-666C-4898-A27B-3AAC1A74908D"
} ,
{
"vulnerable" : true ,
"criteria" : "cpe:2.3:o:gl-inet:gl-mt3000_firmware:4.4.6:*:*:*:*:*:*:*" ,
"matchCriteriaId" : "12F39096-F3A6-4240-9CCF-3CEB44A549D4"
}
]
2024-12-08 03:06:42 +00:00
} ,
2024-01-19 03:00:28 +00:00
{
"operator" : "OR" ,
"negate" : false ,
"cpeMatch" : [
{
"vulnerable" : false ,
2024-12-08 03:06:42 +00:00
"criteria" : "cpe:2.3:h:gl-inet:gl-mt3000:-:*:*:*:*:*:*:*" ,
"matchCriteriaId" : "4D832083-488B-40F2-8D7A-66E917DF67F9"
2024-01-19 03:00:28 +00:00
}
]
2024-12-08 03:06:42 +00:00
}
]
} ,
{
"operator" : "AND" ,
"nodes" : [
2024-01-19 03:00:28 +00:00
{
"operator" : "OR" ,
"negate" : false ,
"cpeMatch" : [
{
"vulnerable" : true ,
"criteria" : "cpe:2.3:o:gl-inet:gl-mt2500_firmware:4.3.7:*:*:*:*:*:*:*" ,
"matchCriteriaId" : "5BDCB33B-3A4D-4F62-A302-73C10852529B"
} ,
{
"vulnerable" : true ,
"criteria" : "cpe:2.3:o:gl-inet:gl-mt2500_firmware:4.4.6:*:*:*:*:*:*:*" ,
"matchCriteriaId" : "D78DCE77-BBC1-4702-89F3-A2064A82ED85"
}
]
2024-12-08 03:06:42 +00:00
} ,
2024-01-19 03:00:28 +00:00
{
"operator" : "OR" ,
"negate" : false ,
"cpeMatch" : [
{
"vulnerable" : false ,
2024-12-08 03:06:42 +00:00
"criteria" : "cpe:2.3:h:gl-inet:gl-mt2500:-:*:*:*:*:*:*:*" ,
"matchCriteriaId" : "88C600EF-AF68-45F0-B9C0-7ECA0D33179C"
2024-01-19 03:00:28 +00:00
}
]
2024-12-08 03:06:42 +00:00
}
]
} ,
{
"operator" : "AND" ,
"nodes" : [
2024-01-19 03:00:28 +00:00
{
"operator" : "OR" ,
"negate" : false ,
"cpeMatch" : [
{
"vulnerable" : true ,
"criteria" : "cpe:2.3:o:gl-inet:gl-mt6000_firmware:4.3.7:*:*:*:*:*:*:*" ,
"matchCriteriaId" : "E0991507-2442-42D2-AFB2-79D91F631CC7"
} ,
{
"vulnerable" : true ,
"criteria" : "cpe:2.3:o:gl-inet:gl-mt6000_firmware:4.4.6:*:*:*:*:*:*:*" ,
"matchCriteriaId" : "BB2FAEE3-AF10-4D2A-9A5B-8F783613AC7F"
}
]
2024-12-08 03:06:42 +00:00
} ,
2024-01-19 03:00:28 +00:00
{
"operator" : "OR" ,
"negate" : false ,
"cpeMatch" : [
{
"vulnerable" : false ,
2024-12-08 03:06:42 +00:00
"criteria" : "cpe:2.3:h:gl-inet:gl-mt6000:-:*:*:*:*:*:*:*" ,
"matchCriteriaId" : "0480E0BD-DAEE-42E7-A6EB-BC09889CC7B9"
2024-01-19 03:00:28 +00:00
}
]
2024-12-08 03:06:42 +00:00
}
]
} ,
{
"operator" : "AND" ,
"nodes" : [
2024-01-19 03:00:28 +00:00
{
"operator" : "OR" ,
"negate" : false ,
"cpeMatch" : [
{
"vulnerable" : true ,
"criteria" : "cpe:2.3:o:gl-inet:gl-mt1300_firmware:4.3.7:*:*:*:*:*:*:*" ,
"matchCriteriaId" : "D462B247-60E8-4044-B413-D145F342F8BA"
} ,
{
"vulnerable" : true ,
"criteria" : "cpe:2.3:o:gl-inet:gl-mt1300_firmware:4.4.6:*:*:*:*:*:*:*" ,
"matchCriteriaId" : "843FD80C-235B-4B28-9D98-8DDBFED335D4"
}
]
2024-12-08 03:06:42 +00:00
} ,
2024-01-19 03:00:28 +00:00
{
"operator" : "OR" ,
"negate" : false ,
"cpeMatch" : [
{
"vulnerable" : false ,
2024-12-08 03:06:42 +00:00
"criteria" : "cpe:2.3:h:gl-inet:gl-mt1300:-:*:*:*:*:*:*:*" ,
"matchCriteriaId" : "65A8D1C9-9EAE-4EDF-A1D4-D45E9EE65585"
2024-01-19 03:00:28 +00:00
}
]
2024-12-08 03:06:42 +00:00
}
]
} ,
{
"operator" : "AND" ,
"nodes" : [
2024-01-19 03:00:28 +00:00
{
"operator" : "OR" ,
"negate" : false ,
"cpeMatch" : [
{
"vulnerable" : true ,
"criteria" : "cpe:2.3:o:gl-inet:gl-mt300n-v2_firmware:4.3.7:*:*:*:*:*:*:*" ,
"matchCriteriaId" : "7469E6FA-07DB-430D-BAD8-21AF64C55FBA"
} ,
{
"vulnerable" : true ,
"criteria" : "cpe:2.3:o:gl-inet:gl-mt300n-v2_firmware:4.4.6:*:*:*:*:*:*:*" ,
"matchCriteriaId" : "C6E6EF01-62DC-438B-B975-C3DF84DC6E52"
}
]
2024-12-08 03:06:42 +00:00
} ,
{
"operator" : "OR" ,
"negate" : false ,
"cpeMatch" : [
{
"vulnerable" : false ,
"criteria" : "cpe:2.3:h:gl-inet:gl-mt300n-v2:-:*:*:*:*:*:*:*" ,
"matchCriteriaId" : "EA4A042E-2C80-4EF9-93CA-D2756216BB0C"
}
]
2024-01-19 03:00:28 +00:00
}
]
} ,
{
"operator" : "AND" ,
"nodes" : [
{
"operator" : "OR" ,
"negate" : false ,
"cpeMatch" : [
{
"vulnerable" : true ,
"criteria" : "cpe:2.3:o:gl-inet:gl-ar750s_firmware:4.3.7:*:*:*:*:*:*:*" ,
"matchCriteriaId" : "4037EFB4-EA0A-4C89-800A-2990AA8BC185"
} ,
{
"vulnerable" : true ,
"criteria" : "cpe:2.3:o:gl-inet:gl-ar750s_firmware:4.4.6:*:*:*:*:*:*:*" ,
"matchCriteriaId" : "F760479D-D8E7-4AC2-8083-AAE870225CE7"
}
]
} ,
{
"operator" : "OR" ,
"negate" : false ,
"cpeMatch" : [
{
"vulnerable" : false ,
"criteria" : "cpe:2.3:h:gl-inet:gl-ar750s:-:*:*:*:*:*:*:*" ,
"matchCriteriaId" : "8C939D70-5353-43B7-AEF9-8F1D784DD4EF"
}
]
}
]
} ,
{
"operator" : "AND" ,
"nodes" : [
{
"operator" : "OR" ,
"negate" : false ,
"cpeMatch" : [
{
"vulnerable" : true ,
"criteria" : "cpe:2.3:o:gl-inet:gl-ar750_firmware:4.3.7:*:*:*:*:*:*:*" ,
"matchCriteriaId" : "ACAAD071-0070-48B9-9797-26B1D5CAC962"
} ,
{
"vulnerable" : true ,
"criteria" : "cpe:2.3:o:gl-inet:gl-ar750_firmware:4.4.6:*:*:*:*:*:*:*" ,
"matchCriteriaId" : "C03FF3D4-BC96-42DB-8EC6-466A1C02B534"
}
]
} ,
{
"operator" : "OR" ,
"negate" : false ,
"cpeMatch" : [
{
"vulnerable" : false ,
"criteria" : "cpe:2.3:h:gl-inet:gl-ar750:-:*:*:*:*:*:*:*" ,
"matchCriteriaId" : "6FE176E8-8CB1-429B-9B3B-E1F58EC0C8F5"
}
]
}
]
} ,
{
"operator" : "AND" ,
"nodes" : [
{
"operator" : "OR" ,
"negate" : false ,
"cpeMatch" : [
{
"vulnerable" : true ,
"criteria" : "cpe:2.3:o:gl-inet:gl-ar300m_firmware:4.3.7:*:*:*:*:*:*:*" ,
"matchCriteriaId" : "E267A0D1-8D9B-43A9-88F0-3CA961403FBC"
} ,
{
"vulnerable" : true ,
"criteria" : "cpe:2.3:o:gl-inet:gl-ar300m_firmware:4.4.6:*:*:*:*:*:*:*" ,
"matchCriteriaId" : "551632B5-BBAC-4A4D-96BD-8D49EF3A5EFB"
}
]
} ,
{
"operator" : "OR" ,
"negate" : false ,
"cpeMatch" : [
{
"vulnerable" : false ,
"criteria" : "cpe:2.3:h:gl-inet:gl-ar300m:-:*:*:*:*:*:*:*" ,
"matchCriteriaId" : "10C965DA-2D49-4ED6-B028-3A23164EDC14"
}
]
}
]
} ,
{
"operator" : "AND" ,
"nodes" : [
{
"operator" : "OR" ,
"negate" : false ,
"cpeMatch" : [
{
"vulnerable" : true ,
"criteria" : "cpe:2.3:o:gl-inet:gl-b1300_firmware:4.3.7:*:*:*:*:*:*:*" ,
"matchCriteriaId" : "9E6AF4D2-8BD0-4536-82AA-A9A06441DB59"
} ,
{
"vulnerable" : true ,
"criteria" : "cpe:2.3:o:gl-inet:gl-b1300_firmware:4.4.6:*:*:*:*:*:*:*" ,
"matchCriteriaId" : "AFBE858E-8D41-4221-8520-25BA35EFE8D3"
}
]
} ,
{
"operator" : "OR" ,
"negate" : false ,
"cpeMatch" : [
{
"vulnerable" : false ,
"criteria" : "cpe:2.3:h:gl-inet:gl-b1300:-:*:*:*:*:*:*:*" ,
"matchCriteriaId" : "10D84ECB-35CB-42B0-B925-8B631C235CC2"
}
]
}
]
} ,
{
"operator" : "AND" ,
"nodes" : [
{
"operator" : "OR" ,
"negate" : false ,
"cpeMatch" : [
{
"vulnerable" : true ,
"criteria" : "cpe:2.3:o:gl-inet:gl-a1300_firmware:4.3.7:*:*:*:*:*:*:*" ,
"matchCriteriaId" : "1D582CF8-55A2-4261-84A3-DB5677C569D2"
} ,
{
"vulnerable" : true ,
"criteria" : "cpe:2.3:o:gl-inet:gl-a1300_firmware:4.4.6:*:*:*:*:*:*:*" ,
"matchCriteriaId" : "789782AD-CCC9-403C-810A-F634B09EEB5B"
}
]
} ,
{
"operator" : "OR" ,
"negate" : false ,
"cpeMatch" : [
{
"vulnerable" : false ,
"criteria" : "cpe:2.3:h:gl-inet:gl-a1300:-:*:*:*:*:*:*:*" ,
"matchCriteriaId" : "2365517B-F8AF-490D-9282-36679EB484D2"
}
]
}
]
}
] ,
2024-01-12 09:00:28 +00:00
"references" : [
2024-01-24 17:00:29 +00:00
{
"url" : "http://packetstormsecurity.com/files/176708/GL.iNet-Unauthenticated-Remote-Command-Execution.html" ,
"source" : "cve@mitre.org"
} ,
2024-01-12 09:00:28 +00:00
{
"url" : "https://github.com/gl-inet/CVE-issues/blob/main/4.0.0/Authentication-bypass.md" ,
2024-01-19 03:00:28 +00:00
"source" : "cve@mitre.org" ,
"tags" : [
"Exploit" ,
"Issue Tracking" ,
"Vendor Advisory"
]
2024-12-08 03:06:42 +00:00
} ,
{
"url" : "http://packetstormsecurity.com/files/176708/GL.iNet-Unauthenticated-Remote-Command-Execution.html" ,
"source" : "af854a3a-2127-422b-91ae-364da2661108"
} ,
{
"url" : "https://github.com/gl-inet/CVE-issues/blob/main/4.0.0/Authentication-bypass.md" ,
"source" : "af854a3a-2127-422b-91ae-364da2661108" ,
"tags" : [
"Exploit" ,
"Issue Tracking" ,
"Vendor Advisory"
]
2024-01-12 09:00:28 +00:00
}
]
}
