CVE-2023-50919 is a critical authentication bypass in GL.iNet routers, scored 9.8. The NGINX front end can be bypassed through Lua string pattern matching. The record says devices before firmware 4.5.0 are affected, so update to 4.5.0 or later and confirm the build with the vendor.
What's affected
The record says GL.iNet devices before version 4.5.0 are affected. It lists these models and builds: A1300, AX1800, AXT1800, MT3000 and MT2500 on 4.4.6, MT6000 on 4.5.0, and MT1300, MT300N-V2, AR750S, AR750, AR300M and B1300 on 4.3.7.
The sources are not consistent about 4.5.0. The record says "before version 4.5.0" yet lists the MT6000 on 4.5.0 as affected. The vendor's own issue page states fixed in 4.5.0 and also lists 4.5.0 as affected. So 4.5.0 may be the fixed build for some models and not others. Confirm with GL.iNet before relying on it.
NVD scores it 9.8 (Critical) with the vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. The vendor page describes the flaw in the local web login: a remote attacker can log in as root without a valid username and password. The record was published on 2024-01-12. This post does not include technical steps to use it.
How to check if you're exposed
Open the router admin panel and read the firmware version on the system page, then match it against the model list above.
Check exposure next. A router whose admin interface is reachable only from the LAN is much safer than one exposed to the internet. Look for remote access, port forwards to the admin port, and any cloud or remote management feature that is turned on.
Because these are small travel and branch routers, many of them are in the field. Keep a list of the model and firmware for each unit and the person who holds it.
What to do now
- List all GL.iNet routers and their firmware versions.
- Update each to the latest firmware from GL.iNet, at minimum 4.5.0, and confirm the fix applies to your model.
- Disable remote access to the admin interface from the internet.
- Change the admin password and restrict the interface to trusted hosts.
- Treat any exposed unit as possibly compromised: reset it and re-enter configuration.
Why it matters
The weakness is improper authentication, CWE-287. In this design NGINX decides who may reach protected API calls, using Lua code that matches strings. If the matching accepts input the developer did not expect, a protected path can be treated as public.
Routers run the web service as a privileged process, so an authentication bypass leads quickly to full control of the device. That affects all traffic that passes through it.
The record shows no CISA Known Exploited Vulnerabilities listing. The record links a Packet Storm file about unauthenticated remote command execution on GL.iNet devices, which was not fetched here, so this post makes no claim about exploitation.
Quick check
Which firmware fixes it?
The vendor says 4.5.0, but its pages also list 4.5.0 as affected for some models. Confirm the fixed build for your model with GL.iNet.
Is it exploitable from the internet?
The vector is network based with no privileges. It matters most where the admin interface is exposed, so turn off remote access.
Sources
Last reviewed: 19 October 2026.
