CVE-2023-46453: GL.iNet Auth Bypass Vulnerability

CVE-2023-46453 Overview

CVE-2023-46453 is an authentication bypass vulnerability affecting GL.iNet routers running 4.x firmware. The flaw exists in the login authentication logic, which processes usernames that are simultaneously valid SQL statements and valid regular expressions. Attackers can craft a specially formed username to bypass authentication entirely and obtain administrative control of the device. The issue is classified as SQL Injection [CWE-89] and is reachable remotely over the network without prior credentials or user interaction. Confirmed affected firmware includes version 4.3.7 across the GL-MT3000, GL-AR300M, GL-B1300, GL-AX1800, GL-AR750S, GL-MT2500, GL-AXT1800, GL-X3000, and GL-SFT1200 models.

Critical Impact
Unauthenticated remote attackers gain full administrative control over affected GL.iNet routers, enabling traffic interception, persistent backdoors, and lateral movement into internal networks.

Affected Products

GL.iNet routers running 4.x firmware (confirmed on 4.3.7)
Hardware models: GL-MT3000, GL-AR300M, GL-B1300, GL-AX1800, GL-AR750S
Hardware models: GL-MT2500, GL-AXT1800, GL-X3000, GL-SFT1200

Discovery Timeline

2026-05-08 - CVE-2023-46453 published to NVD
2026-05-08 - Last updated in NVD database

Technical Details for CVE-2023-46453

Vulnerability Analysis

The vulnerability resides in the authentication routine of the GL.iNet web management interface. The login handler accepts a username parameter and incorporates it into a database lookup without proper parameterization. Because the same input is also evaluated against regular expression logic during authentication, an attacker can supply a value that satisfies both contexts. The result is that the authentication query returns a truthy match while the regex check accepts the same string. The attacker is granted an authenticated administrative session without supplying a valid password. With administrative access, attackers can modify firewall rules, change DNS settings, deploy malicious firmware, pivot into the LAN, and intercept all traffic transiting the device.

Root Cause

The root cause is improper neutralization of special elements used in a SQL command [CWE-89]. User-controlled input from the username field is concatenated into a SQL query rather than bound through prepared statements. The authentication logic compounds the issue by treating the same input as a regular expression, allowing a single payload to manipulate both the database query and the comparison operation that grants access.

Attack Vector

The attack vector is the network-facing administrative web interface exposed by the router. An attacker sends an HTTP request to the login endpoint containing a crafted username that closes the original SQL statement, injects a tautology, and remains a valid regular expression. No credentials, user interaction, or local access are required. Devices exposing the management interface to the WAN are at immediate risk, but LAN-side attackers can also exploit the flaw from any connected client.

No verified proof-of-concept code is reproduced here. See the Exploit-DB #51865 entry for the published technical details and payload structure.

Detection Methods for CVE-2023-46453

Indicators of Compromise

HTTP POST requests to the router login endpoint containing SQL metacharacters such as single quotes, OR, --, or regex anchors in the username field.
Unexpected successful administrative sessions originating from external IP addresses or from clients that have not previously authenticated.
New or modified configuration entries, firewall rules, port forwards, or DNS settings appearing without administrator action.

Detection Strategies

Inspect router and upstream proxy logs for malformed usernames containing SQL syntax or regex constructs submitted to /cgi-bin/ authentication paths.
Correlate authentication success events with the absence of corresponding password validation entries in device logs.
Compare running firmware version against the GL.iNet 4.x release notes to identify devices still on vulnerable builds.

Monitoring Recommendations

Forward router syslog data to a centralized log platform and alert on repeated failed logins followed by sudden administrative success.
Monitor outbound traffic from routers for connections to unfamiliar command-and-control infrastructure or DNS resolvers.
Track firmware version inventory across deployed GL.iNet devices and flag any device that remains on a 4.x build prior to the vendor fix.

How to Mitigate CVE-2023-46453

Immediate Actions Required

Disable WAN-side access to the router administration interface until the device is patched.
Upgrade affected GL.iNet devices to the latest firmware release that addresses CVE-2023-46453.
Rotate all administrative credentials, Wi-Fi pre-shared keys, and any API tokens stored on the device after patching.
Review device configuration for unauthorized changes to firewall, DNS, VPN, and port-forwarding settings.

Patch Information

GL.iNet has issued firmware updates for affected models that remediate the SQL injection in the authentication routine. Administrators should consult the official GL.iNet firmware download portal for the model-specific image and verify that the installed version is later than 4.3.7. Refer to Exploit-DB #51865 for the original technical disclosure.

Workarounds

Restrict access to the router web UI to a trusted management VLAN or specific LAN IP addresses via firewall rules.
Place the device behind a network segment that requires VPN access before reaching the administrative interface.
Disable remote management features such as cloud management and HTTPS WAN access until firmware can be applied.

bash

# Example: restrict admin UI to a single management host using iptables on the router
iptables -I INPUT -p tcp --dport 80 -i eth0 -j DROP
iptables -I INPUT -p tcp --dport 443 -i eth0 -j DROP
iptables -I INPUT -p tcp --dport 80 -s 192.168.8.10 -j ACCEPT
iptables -I INPUT -p tcp --dport 443 -s 192.168.8.10 -j ACCEPT