CVE-2023-38945 is a Critical severity (CVSS 9.8 in the record) access control bypass in Multilaser RE160, RE160V and RE163V routers, reached with a crafted URL. The researchers say RE160V needs V12.03.01.12, RE163V needs V12.03.01.10 or newer, and the old RE160 will not be patched.
What's affected
The NVD record lists Multilaser RE160 firmware V5.07.51_pt_MTL01 and V5.07.52_pt_MTL01, RE160V firmware V12.03.01.08_pt and V12.03.01.09_pt, and RE163V firmware V12.03.01.08_pt. The researchers' advisory marks those as verified and says other models may be affected.
Fixes according to the advisory:
- RE160V: firmware V12.03.01.12 or newer.
- RE163V: firmware V12.03.01.10 or newer.
- RE160: no fix. Multilaser told the researchers that the firmware vendor was contacted but that, because of the age and limits of the hardware, the RE160 will not receive an update. The advisory recommends replacing it with a model that is still supported, such as the RE160V or RE163V.
Severity differs between sources. NVD scores 9.8 Critical under CVSS 3.1. The researchers' advisory scores 7.7 High under CVSS 4.0.
How to check if you're exposed
Log in to the router's web interface from inside your network and read the firmware version on its status or system page. Compare it to the versions listed above. Do not test for the flaw by probing the device from the internet.
Also check whether remote management is switched on. The advisory lists enabling router remote access among the actions an attacker could take after the bypass, so a router that was ever reachable from outside deserves a closer look: review its DNS settings, routing table and remote access setting for changes you did not make.
If the model label reads RE160 without the V suffix, assume there is no patch for it, regardless of the firmware version it shows.
What to do now
- Identify RE160, RE160V and RE163V units, and note which models you have, since the RE160 has no fix.
- Update RE160V to V12.03.01.12 or newer and RE163V to V12.03.01.10 or newer.
- Replace any RE160 with a supported router, as the advisory recommends, and retire the old unit.
- Until replacement, make sure the web interface cannot be reached from the internet or from untrusted networks, and turn off remote administration.
- Check the DNS servers, routing table and remote management settings for changes you did not make, and change the router's web and WiFi passwords after updating, since the advisory notes these can be retrieved.
Why it matters
The record maps this to CWE-284 (improper access control). The management interface applies its login check based on what the requested URL looks like, and a crafted URL can step around that check. As with the header and cookie variants of the same research, the server should require a valid session token before it serves any management function.
This is one of three related bypasses reported by the same team for these routers, each using a different trick. That is a pattern worth noting: when one access control check is unreliable, others often are too, and a router with several known bypasses should not be trusted to guard a sensitive network. For a device that will never be patched, the safe answer is replacement. The record does not mark the CVE as exploited, and it is not in the CISA Known Exploited Vulnerabilities catalog.
Quick check
My RE160 shows the latest firmware. Am I safe?
No. The advisory says the RE160 will not receive a fix, and the latest firmware it lists is still affected. The recommendation is to replace it.
Are there related CVEs for these routers?
Yes. CVE-2023-38944 involves a header and CVE-2023-38946 involves a cookie, from the same research. All three are access control bypasses.
Sources
- Tempest Security Intelligence advisory for the Multilaser router flaws, Full Disclosure mailing list, 28 February 2024
- Record data for CVE-2023-38945
Last reviewed: 19 October 2026.
