CVE-2023-38944: Critical Access Control Bypass in Multilaser RE160V

CVE-2023-38944 is a Critical severity (CVSS 9.8 in the record) access control bypass in Multilaser RE160V and RE163V routers, triggered by changing an HTTP header. It gives full access to the web management interface. The researchers' advisory says to update to firmware V12.03.01.12 or newer.

What's affected

The NVD record lists Multilaser RE160V firmware V12.03.01.09_pt and RE163V firmware V12.03.01.10_pt. The advisory published by the researchers at Tempest Security Intelligence confirms those two builds as verified affected and says other routers or versions may also be affected.

The fix, per that advisory, is firmware V12.03.01.12 or newer for both models. The advisory's timeline says the vendor fixed the RE163V on 30 August 2023 and the RE160V on 16 October 2023, and published the updates on its support site on 26 October 2023.

There is a severity disagreement between sources. The NVD record scores this 9.8 Critical (CVSS 3.1). The researchers' own advisory scores it 7.7 High using CVSS 4.0, with a vector that marks user interaction as passive. Both are given here because organizations score against whichever version their tooling uses.

How to check if you're exposed

Log in to the router's web interface from inside your network and read the firmware version on its status or system page. Compare it to the versions listed above. Do not test for the flaw by probing the device from the internet.

Also check whether remote management is switched on. The advisory lists enabling router remote access among the actions an attacker could take after the bypass, so a router that was ever reachable from outside deserves a closer look: review its DNS settings, routing table and remote access setting for changes you did not make.

What to do now

1. Identify every Multilaser RE160V and RE163V in use, including ones installed at branch offices and in homes of staff who work remotely.
2. Download firmware V12.03.01.12 or newer from the vendor's support pages for your exact model, and apply it.
3. Confirm the new version in the web interface after the router restarts.
4. Check the DNS servers, routing table and remote management settings for changes you did not make, and change the router's web and WiFi passwords after updating, since the advisory notes these can be retrieved.
5. Turn off remote administration unless you need it, and never expose the web interface to the internet.

Why it matters

The weakness is CWE-269 (improper privilege management). The router's web interface is meant to ask for a login before it allows management actions. Here the check can be skipped by manipulating part of an HTTP request, so the login is not enforced for a request that should have been refused. The advisory describes the lesson plainly: the server should always validate the session token before granting access, regardless of any header.

What an attacker gains is control of a network edge device. The advisory lists changing DNS settings, enabling remote access, changing the routing table and retrieving WiFi and management passwords. Changed DNS is a common way to redirect users to look-alike sites. The record does not mark the CVE as exploited, and it is not in the CISA Known Exploited Vulnerabilities catalog.

Try it yourself

Click through it at your own pace, or open it full screen.

Quick check

Sources

• Tempest Security Intelligence advisory for the Multilaser router flaws, Full Disclosure mailing list, 28 February 2024
• Record data for CVE-2023-38944

Last reviewed: 19 October 2026.