CVEvulnerability

CVE-2023-33621

5.9 MEDIUM Published 2023-06-13 Modified 2026-07-09 Official page ↗
Status
Modified
Published
2023-06-13
Last modified
2026-07-09
Assigner
[email protected]
CVSS 3.1 ([email protected])
5.9 MEDIUM — CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
Weaknesses
CWE-294

Description

GL.iNET GL-AR750S-Ext firmware v3.215 inserts the admin authentication token into a GET request when the OpenVPN Server config file is downloaded. The token is then left in the browser history or access logs, potentially allowing attackers to bypass authentication via session replay.

Affected configurations

• gl-inet gl-ar750s firmware 3.215

Related

Weakness · CWE (1)

  • CWE-294 Authentication Bypass by Capture-replay weakness

References