TI-2023-16601 Aliases CVE-2023-33621 GHSA-cg99-p6r9-c75p

GL.iNET GL-AR750S-Ext firmware v3.215 inserts the admin authentication token into a GET…

MEDIUM 60CWE-294Published 2023-06-13 · Updated 2026-07-09

Key facts

Attack vector: Network
Privileges required: None
User interaction: None
Attack complexity: High
Impact type: Security bypass
Confidentiality · integrity · availability: High · None · None
Fix status: No fix listed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-294.

Summary

GL.iNET GL-AR750S-Ext firmware v3.215 inserts the admin authentication token into a GET request when the OpenVPN Server config file is downloaded. The token is then left in the browser history or access logs, potentially allowing attackers to bypass authentication via session replay.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV

EPSS 0.00714 53rd percentileScored 2026-11-07

Public exploit Yes 1 exploit referenceTagged by NVD

Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: Poc
Automatable: No
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
—	—	all versions	—	No fix listed	CNA

— Vendor— Affected all versions Fixed in — No fix listed CNA

CPE configurations NVD · 2

CPE	Versions	Role	Vendor
cpe:2.3:o:gl-inet:gl-ar750s_firmware:3.215:::::::*	3.215	Vulnerable	GL.iNet
cpe:2.3:h:gl-inet:gl-ar750s:-:::::::*	not specified by NVD	Running on	GL.iNet

cpe:2.3:o:gl-inet:gl-ar750s_firmware:3.215:*:*:*:*:*:*:* Versions 3.215 Vulnerable ·GL.iNet
cpe:2.3:h:gl-inet:gl-ar750s:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·GL.iNet

Remediation

No fixed version listed by the sources yet.

Timeline

2026-10-02 Threatist record created from CVE-2023-33621
2026-10-03 Alias added: GHSA-cg99-p6r9-c75p

References

Exploit 1

https://justinapplegate.me/2023/glinet-CVE-2023-33621/

TI-2023-27815 An issue was discovered on GL.iNet devices before version 4.5.0. CVSS 3.1CRITICAL 9.8
TI-2023-15082 An issue was discovered on GL.iNet devices before 3.216. CVSS 3.1CRITICAL 9.8
TI-2023-15086 An issue was discovered on GL.iNet devices before 3.216. CVSS 3.1CRITICAL 9.8
TI-2023-15088 A path traversal issue was discovered on GL.iNet devices before 3.216. CVSS 3.1HIGH 7.5
TI-2023-15083 An issue was discovered on GL.iNet devices before 3.216. CVSS 3.1HIGH 7.5
TI-2023-27818 An issue was discovered on GL.iNet devices through 4.5.0. CVSS 3.1HIGH 7.2

See all 13 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences