CVE-2023-50922: Unrestricted Upload of File with Dangerous Type

An issue was discovered on GL.iNet devices through 4.5.0. Attackers who are able to steal the AdminToken cookie can execute arbitrary code by uploading a crontab-formatted file to a specific directory and waiting for its execution. This affects A1300 4.4.6, AX1800 4.4.6, AXT1800 4.4.6, MT3000...

PT-2024-14010

Name of the Vulnerable Software and Affected Versions GL.iNet devices versions 4.3.7 through 4.5.0 Description An issue was discovered on GL.iNet devices. Attackers who are able to steal the AdminToken cookie can execute arbitrary code by uploading a crontab-formatted file to a specific directory...