Ghostwire

CVE-2023-46453: Certain GL.iNet devices with 4.x firmware allow authentication bypass (resulting in administrative control of the...

CRITICAL CVSS 9.5 Exploit Available

Published: May 8, 2026 | Last Modified: May 8, 2026

Description

Certain GL.iNet devices with 4.x firmware allow authentication bypass (resulting in administrative control of the device) via a username that is both a valid SQL statement and a valid regular expression. For example, this affects version 4.3.7 on GL-MT3000 GL-AR300M GL-B1300 GL-AX1800 GL-AR750S GL-MT2500 GL-AXT1800 GL-X3000 and GL-SFT1200.

Ghostwire Analysis — What This Means Practically

Critical CVSS score indicates maximum severity — remote code execution, authentication bypass, or complete system compromise is likely possible.
Exploit code is reported to be available, increasing the likelihood of active exploitation.

This analysis is generated by Ghostwire from NVD, CISA KEV, EPSS, and open-source intelligence data. Verify findings through primary sources before acting.

CVE-2023-46453: Certain GL.iNet devices with 4.x firmware allow authentication bypass (resulting in administrative control of the...

Description

Ghostwire Analysis — What This Means Practically

Security Coverage (2 articles)

References