CVE-2023-33621: Medium severity gl-inet Gl-ar750s Firmware vulnerability
GL.iNET GL-AR750S-Ext firmware v3.215 inserts the admin authentication token into a GET request when the OpenVPN Server config file is downloaded. The token is then left in the browser history or access logs, potentially allowing attackers to bypass authentication via session replay.
Affected Software
Event History
Frequently Asked Questions
What is CVE-2023-33621?
CVE-2023-33621 is a vulnerability in GL.iNET GL-AR750S-Ext firmware v3.215 that inserts the admin authentication token into a GET request when the OpenVPN Server config file is downloaded.
How does CVE-2023-33621 work?
CVE-2023-33621 works by inserting the admin authentication token into a GET request, which is then left in the browser history or access logs, potentially allowing attackers to bypass authentication via session replay.
What is the severity of CVE-2023-33621?
CVE-2023-33621 has a severity keyword of 'medium' and a severity value of 5.9.
How can I fix CVE-2023-33621?
To fix CVE-2023-33621, it is recommended to update the GL.iNET GL-AR750S-Ext firmware to a version higher than 3.215.
Where can I find more information about CVE-2023-33621?
You can find more information about CVE-2023-33621 at the following references: [http://gl-ar750s-ext.com](http://gl-ar750s-ext.com), [http://glinet.com](http://glinet.com), [https://justinapplegate.me/2023/glinet-CVE-2023-33621/](https://justinapplegate.me/2023/glinet-CVE-2023-33621/)