CVE-2023-50922 Information
Jan 04, 2024
cve
Description
An issue was discovered on GL.iNet devices through 4.5.0. Attackers who are able to steal the AdminToken cookie can execute arbitrary code by uploading a crontab-formatted file to a specific directory and waiting for its execution. This affects A1300 4.4.6 AX1800 4.4.6 AXT1800 4.4.6 MT3000 4.4.6 MT2500 4.4.6 MT6000 4.5.0 MT1300 4.3.7 MT300N-V2 4.3.7 AR750S 4.3.7 AR750 4.3.7 AR300M 4.3.7 and B1300 4.3.7.