CVE-2023-46453 Auth bypass in n/a
Attackers can bypass authentication on GL.iNet routers using crafted SQL/regex usernames to gain administrative control.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2023-46453?
CVE-2023-46453 is a critical authentication bypass vulnerability in n/a, published on 8 May 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Certain GL.iNet devices with 4.x firmware allow authentication bypass (resulting in administrative control of the device) via a username that is both a valid SQL statement and a valid regular expression. For example, this affects version 4.3.7 on GL-MT3000 GL-AR300M GL-B1300 GL-AX1800 GL-AR750S GL-MT2500 GL-AXT1800 GL-X3000 and GL-SFT1200.
Weakness: CWE-89
Which versions are affected by CVE-2023-46453?
How do I fix CVE-2023-46453?
No fix has been published for CVE-2023-46453 yet. Limit exposure of the affected software until one is available.
Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.
Is CVE-2023-46453 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2023-46453 exists.
Sources
Also known as GHSA-vx26-r59q-724x.