CVE-2023-33621

Published: Jun 13, 2023Modified: Jul 9, 2026

5.9

Vector

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

Exploitability: 2.2 / Impact: 3.6

Source: NVD

Description

GL.iNET GL-AR750S-Ext firmware v3.215 inserts the admin authentication token into a GET request when the OpenVPN Server config file is downloaded. The token is then left in the browser history or access logs, potentially allowing attackers to bypass authentication via session replay.

Affected (1)

Products: Gl Inet: Gl Ar750s Firmware

1 product

Gl Ar750s Firmware

Configuration A

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Gl Inet Gl Ar750s Firmware	Version 3.215

Running on/with	Platform Versions
Gl Inet Gl Ar750s	All versions

Related CWEs

Authentication Bypass by Capture-replay

A capture-replay flaw exists when the design of the product makes it possible for a malicious user to sniff network traffic and bypass authentication by replaying it to the server in question to the same effect as the original message (or with minor changes).

References (2)

https://justinapplegate.me/2023/glinet-CVE-2023-33621/

Source: cve@mitre.org

ExploitThird Party Advisory

https://justinapplegate.me/2023/glinet-CVE-2023-33621/

Source: af854a3a-2127-422b-91ae-364da2661108

ExploitThird Party Advisory

Timeline

No history available yet.