CVE-2023-47677 is a cross-site request forgery flaw in the boa web server of the Realtek rtl819x Jungle SDK 3.4.11. NVD scores it 8.8, High. The record also lists the Level1 WBR-6013 router firmware. I could not read the advisory page or confirm a fix, so check with the device maker.
What's affected
The record lists the Realtek rtl819x Jungle SDK version 3.4.11, the Level1 WBR-6013 router, and its firmware build rer4_a_v3411b_2t2r_lev_09_170623. The weakness is CWE-352, cross-site request forgery.
The reference is a Cisco Talos report, TALOS-2023-1872. The Talos site blocked my automated request, so I could not read the report. Everything here comes from the NVD record: the description says a specially crafted network request can lead to CSRF, in the boa CSRF protection functionality.
No fixed version is named in the record. SDK code is shared by many router makers, so other devices built on the same SDK version could be affected. The record names only one product.
The NVD vector is CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. User interaction is required, which fits a CSRF flaw: a signed-in user has to load something the attacker controls.
How to check if you're exposed
Log in to the router's admin page and read the firmware version. The build named in the record is rer4_a_v3411b_2t2r_lev_09_170623 for the Level1 WBR-6013.
For other routers, look for the SDK name or version in the firmware information screen or the vendor's release notes. Many vendors do not state the SDK, so the question to ask the vendor is whether the product uses Realtek's rtl819x Jungle SDK 3.4.11.
You can reduce the exposure immediately by changing how you use the admin page. Sign out when you finish, and do not browse other sites in the same browser session while signed in to the router.
What to do now
- Ask the router vendor whether a firmware update addresses CVE-2023-47677, and apply it if one exists.
- Sign out of the router admin page when you are done, and avoid browsing other sites while signed in.
- Make sure the admin page is reachable only from the local network, and not from the internet.
- Change the router admin password if it is still the default.
- Replace the device if the vendor no longer supports it. A router with no firmware updates is a standing risk.
Why it matters
Cross-site request forgery works because the browser sends your credentials with every request to a site, including requests that another site caused it to send. If the router's admin page accepts a state-changing request with no token to prove that the request came from its own page, a malicious page can make your browser change settings for you.
The weakness is CWE-352. The fix is to attach an unpredictable token to each form and check it on the server, and to set cookies so that they are not sent along with cross-site requests. The record calls out the CSRF protection functionality of the boa server, which suggests a protection existed but could be bypassed. I cannot say more without the Talos report.
Why does NVD rate it so high? Router settings control the network. Changing the DNS server or opening a remote administration port are small edits with large consequences. That is how a browser based flaw in a small web server becomes an 8.8.
Quick check
Which devices use this SDK?
The record names the Level1 WBR-6013. Other devices built on the same SDK version may share the flaw, and only the vendor can say.
Is there a fix?
I could not confirm one. The record cites only the Talos report, which I could not read.
Sources
- Cisco Talos report TALOS-2023-1872 (cited in the record; access was blocked for me)
- Safeguard Gold page for CVE-2023-47677
Last reviewed: 19 October 2026.
