CVE-2023-33621
MediumCVSS 5.9Exploitation Probability (EPSS)
Low risk49th percentile - higher than 49% of all known CVEs
Summary
In GL.iNET GL-AR750S-Ext firmware v3.215, the admin authentication token is included in a GET request when downloading the OpenVPN Server config file. The token remains in browser history or access logs, potentially allowing attackers to bypass authentication via session replay.
Risk Assessment
The risk involves an attacker potentially capturing the authentication token, leading to unauthorized access to the device's admin panel and full control over the device.
Recommendation
Immediately update the firmware to the latest version that fixes this vulnerability. Additionally, clear browser history and access logs after downloading the config file.
Original NVD description (English source)
GL.iNET GL-AR750S-Ext firmware v3.215 inserts the admin authentication token into a GET request when the OpenVPN Server config file is downloaded. The token is then left in the browser history or access logs, potentially allowing attackers to bypass authentication via session replay.