CVE-2023-50919

CRITICAL EXPLOITED

GL.iNet Unauthenticated Remote Command Execution via the logread module.

Title source: metasploit
STIX 2.1

Exploitation Summary

CVE-2023-50919 has been observed exploited in the wild (reported by VulnCheck KEV). EIP tracks 1 public exploit, including a Metasploit module exploits/linux/http/glinet_unauth_rce_cve_2023_50445.

AI-analyzed exploit summary This Metasploit module exploits CVE-2023-50445, a command injection vulnerability in GL.iNet devices, chained with CVE-2023-50919 for authentication bypass. It allows unauthenticated remote command execution via the logread module.

Description

An issue was discovered on GL.iNet devices before version 4.5.0. There is an NGINX authentication bypass via Lua string pattern matching. This affects A1300 4.4.6, AX1800 4.4.6, AXT1800 4.4.6, MT3000 4.4.6, MT2500 4.4.6, MT6000 4.5.0, MT1300 4.3.7, MT300N-V2 4.3.7, AR750S 4.3.7, AR750 4.3.7, AR300M 4.3.7, and B1300 4.3.7.

Exploits (1)

metasploit WORKING POC EXCELLENT
rubypocunix
https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/linux/http/glinet_unauth_rce_cve_2023_50445.rb

This Metasploit module exploits CVE-2023-50445, a command injection vulnerability in GL.iNet devices, chained with CVE-2023-50919 for authentication bypass. It allows unauthenticated remote command execution via the logread module.

Classification
Working Poc 95%
Attack Type
Rce
Complexity
Moderate
Reliability
Reliable
Target: GL.iNet network products (various models and firmware versions)
No auth needed
Prerequisites: Network access to the target device
devstral-2 · analyzed Feb 16, 2026 Full analysis →

References (2)

Core 2

Scores

CVSS v3 9.8
EPSS 0.4808
EPSS Percentile 98.7%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CISA SSVC

Vulnrichment
Exploitation poc
Automatable yes
Technical Impact total

Details

VulnCheck KEV 2025-09-03
CWE
CWE-287
Status published
Products (24)
gl-inet/gl-a1300_firmware 4.3.7
gl-inet/gl-a1300_firmware 4.4.6
gl-inet/gl-ar300m_firmware 4.3.7
gl-inet/gl-ar300m_firmware 4.4.6
gl-inet/gl-ar750_firmware 4.3.7
gl-inet/gl-ar750_firmware 4.4.6
gl-inet/gl-ar750s_firmware 4.3.7
gl-inet/gl-ar750s_firmware 4.4.6
gl-inet/gl-ax1800_firmware 4.3.7
gl-inet/gl-ax1800_firmware 4.4.6
... and 14 more
Published Jan 12, 2024
Tracked Since Feb 18, 2026