CVE-2023-50919
CRITICALCVSS 9.8/10EPSS 47.80%
Last modified
CVE-2023-50919 is a critical-severity vulnerability rated 9.8/10 on the CVSS scale. An issue was discovered on GL.iNet devices before version 4.5.0. There is an NGINX authentication bypass via Lua string pattern matching. EPSS estimates a 47.80% chance of exploitation in the next 30 days.
Description
An issue was discovered on GL.iNet devices before version 4.5.0. There is an NGINX authentication bypass via Lua string pattern matching. This affects A1300 4.4.6, AX1800 4.4.6, AXT1800 4.4.6, MT3000 4.4.6, MT2500 4.4.6, MT6000 4.5.0, MT1300 4.3.7, MT300N-V2 4.3.7, AR750S 4.3.7, AR750 4.3.7, AR300M 4.3.7, and B1300 4.3.7.
Metrics
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Gl-Inet | Gl-Ax1800 Firmware | 4.3.7 |
| Gl-Inet | Gl-Ax1800 Firmware | 4.4.6 |
| Gl-Inet | Gl-Axt1800 Firmware | 4.3.7 |
| Gl-Inet | Gl-Axt1800 Firmware | 4.4.6 |
| Gl-Inet | Gl-Mt3000 Firmware | 4.3.7 |
| Gl-Inet | Gl-Mt3000 Firmware | 4.4.6 |
| Gl-Inet | Gl-Mt2500 Firmware | 4.3.7 |
| Gl-Inet | Gl-Mt2500 Firmware | 4.4.6 |
| Gl-Inet | Gl-Mt6000 Firmware | 4.3.7 |
| Gl-Inet | Gl-Mt6000 Firmware | 4.4.6 |
| Gl-Inet | Gl-Mt1300 Firmware | 4.3.7 |
| Gl-Inet | Gl-Mt1300 Firmware | 4.4.6 |
| Gl-Inet | Gl-Mt300n-V2 Firmware | 4.3.7 |
| Gl-Inet | Gl-Mt300n-V2 Firmware | 4.4.6 |
| Gl-Inet | Gl-Ar750s Firmware | 4.3.7 |
| Gl-Inet | Gl-Ar750s Firmware | 4.4.6 |
| Gl-Inet | Gl-Ar750 Firmware | 4.3.7 |
| Gl-Inet | Gl-Ar750 Firmware | 4.4.6 |
| Gl-Inet | Gl-Ar300m Firmware | 4.3.7 |
| Gl-Inet | Gl-Ar300m Firmware | 4.4.6 |
| Gl-Inet | Gl-B1300 Firmware | 4.3.7 |
| Gl-Inet | Gl-B1300 Firmware | 4.4.6 |
| Gl-Inet | Gl-A1300 Firmware | 4.3.7 |
| Gl-Inet | Gl-A1300 Firmware | 4.4.6 |
References
- https://github.com/gl-inet/CVE-issues/blob/main/4.0.0/Authentication-bypass.mdExploit, Issue Tracking, Vendor Advisory
- https://github.com/gl-inet/CVE-issues/blob/main/4.0.0/Authentication-bypass.mdExploit, Issue Tracking, Vendor Advisory
Timeline
- Published
- Last Modified
- Status
- Modified
Frequently Asked Questions
What is CVE-2023-50919?
An issue was discovered on GL.iNet devices before version 4.5.0. There is an NGINX authentication bypass via Lua string pattern matching. This affects A1300 4.4.6, AX1800 4.4.6, AXT1800 4.4.6, MT3000 4.4.6, MT2500 4.4.6, MT6000 4.5.0, MT1300 4.3.7, MT300N-V2 4.3.7, AR750S 4.3.7, AR750 4.3.7, AR300M 4.3.7, and B1300 4.3.7.
How severe is CVE-2023-50919?
CVE-2023-50919 has a CVSS score of 9.8/10 (CRITICAL severity). The EPSS model estimates a 47.80% probability of exploitation in the next 30 days.
How do I fix CVE-2023-50919?
Check the vendor references and advisories linked above for patched versions and mitigation guidance. You can also run a Strix scan to test if your systems are affected.
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2023
- CVE-2023-50913Oxide control plane software before 5 allows SSRF.9.1
- CVE-2023-50914A Privilege Escalation issue in the inter-process communicat…6.7
- CVE-2023-50915An issue exists in GalaxyClientService.exe in GOG Galaxy (Be…6.5
- CVE-2023-50916Kyocera Device Manager before 3.1.1213.0 allows NTLM credent…7.2
- CVE-2023-50917MajorDoMo (aka Major Domestic Module) before 0662e5e allows …9.8
- CVE-2023-50918app/Controller/AuditLogsController.php in MISP before 2.4.18…9.8
- CVE-2023-5092Rejected reason: This CVE id was assigned to an issue which …
- CVE-2023-50920An issue was discovered on GL.iNet devices before version 4.…5.5
- CVE-2023-50921An issue was discovered on GL.iNet devices through 4.5.0. At…9.8
- CVE-2023-50922An issue was discovered on GL.iNet devices through 4.5.0. At…7.2
- CVE-2023-50923In QUIC in RFC 9000, the Latency Spin Bit specification (sec…4.3
- CVE-2023-50924Englesystem is a shift planning system for chaos events. Eng…5.4
Are you affected by CVE-2023-50919?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST