CVE-2023-38946 is a High severity (CVSS 8.8) access control bypass in Multilaser RE160 routers that abuses a crafted cookie to reach the web management interface. The vendor says the RE160 will not receive a full fix. The researchers recommend replacing it with an RE160V or RE163V.
What's affected
The record lists Multilaser RE160 firmware V5.07.51_pt_MTL01 and V5.07.52_pt_MTL01. The researchers' advisory confirms both builds as affected, and says other versions may be too.
There is no complete fix. The advisory says that updating to the latest firmware, V5.07.52_pt_MTL01, reduces the attack window, limiting exploitation to times when a user has an active session on the router. It also notes that the RE160 is affected by another bypass with the same impact and no such limit, which is CVE-2023-38945. Multilaser told the researchers that the RE160 will not be updated because of its age and hardware limits.
Severity sources differ again. The record scores 8.8 High, with user interaction required in the vector. The researchers scored it 7.7 High using CVSS 4.0. Both agree on High.
How to check if you're exposed
Read the model label on the device and the firmware version on its status page. An RE160 on V5.07.51_pt_MTL01 or V5.07.52_pt_MTL01 is in scope, and because no full fix exists, being on the newest build does not clear it.
Check the router's settings pages from inside your network for changes you did not make: DNS servers, the routing table and the remote access option. Those are the actions the advisory lists as possible after a bypass.
What to do now
- Find all RE160 routers in your estate and note the firmware version of each.
- Plan to replace each RE160 with a supported model such as the RE160V or RE163V, which the advisory names.
- Until replaced, update to V5.07.52_pt_MTL01 to narrow the window, and keep administrators from staying logged in to the web interface.
- Block access to the management interface from the internet and from guest or untrusted networks.
- After replacement, set new management and WiFi passwords on the new device.
Why it matters
The record maps this to CWE-284 (improper access control). In this case the router accepts a request as authenticated based on a cookie value that an outsider can supply, instead of checking a real, unpredictable session token. The advisory's conceptual fix is exactly that: validate the cookie value on the server, and make sure the value cannot be guessed.
The interesting detail is the attack window. With the latest firmware the flaw only works while a legitimate user is logged in, which is a smaller exposure than the unauthenticated variants but still a real one on a shared network. Because there will be no patch, this is a lifecycle problem more than a patching problem: the device has reached the end of what its vendor will support. The record does not mark the CVE as exploited, and it is not in the CISA Known Exploited Vulnerabilities catalog.
Quick check
Does updating the firmware fully fix this?
No. The latest RE160 firmware only narrows the window to when a user session is active. The vendor says there will be no full fix, so replacement is the recommendation.
Why is the score 8.8 and not Critical?
The record's vector requires user interaction and the researchers' own scoring is 7.7 High. Both sources rate it High, not Critical.
Sources
- Tempest Security Intelligence advisory for the Multilaser router flaws, Full Disclosure mailing list, 28 February 2024
- Record data for CVE-2023-38946
Last reviewed: 19 October 2026.
