CVE-2023-50921 is a critical privilege escalation in GL.iNet routers, scored 9.8. The add_user interface in the system module can be used to gain root. The vendor says it is fixed in 4.5.0, but its pages also list 4.5.0 as affected, so confirm the build for your model.
What's affected
The record says GL.iNet devices through 4.5.0 are affected, and lists A1300, AX1800, AXT1800, MT3000 and MT2500 on 4.4.6, MT6000 on 4.5.0, and MT1300, MT300N-V2, AR750S, AR750, AR300M and B1300 on 4.3.7.
The version boundary is unclear. The record says "through 4.5.0", which includes 4.5.0. The vendor's issue page says fixed in 4.5.0 and also lists 4.5.0 as affected. Treat a newer firmware than 4.5.0 as the safe choice where one exists, and ask GL.iNet which build closes the issue for your model.
NVD scores it 9.8 (Critical) with the vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. The vendor page says the add_user function in the system module does not properly filter usernames, which lets an attacker create a root account. The record was published on 2024-01-03.
How to check if you're exposed
Read the firmware version from the router admin panel and match it with the models above. If you cannot tell, check the vendor's download page for the latest firmware for your model and compare.
Then look at accounts on the device. A root level account you did not create is a sign of compromise, so review the user list and any SSH keys.
Exposure again depends on reachability. Devices with the admin interface on the internet are the most at risk, so confirm remote access settings.
What to do now
- Update each affected router to the newest firmware for its model.
- Verify with GL.iNet whether 4.5.0 closes this issue on your model.
- Disable internet access to the admin interface.
- Review user accounts and keys on routers for unexpected entries.
- Reset and reconfigure any router that shows signs of tampering.
Why it matters
The weakness is improper privilege management, CWE-269. A function meant to add a user accepted input without filtering it properly, and the result was a way to obtain root privileges. Account creation is a sensitive operation and needs strict input checks and an authorization check on the caller.
Like the related authentication issue in the same firmware family, this one turns a web interface bug into full device control. Routers sit on the network edge, so the consequences reach all connected devices.
The record shows no CISA Known Exploited Vulnerabilities listing, and the vendor page does not report exploitation in the wild.
Quick check
Is 4.5.0 safe?
The sources are inconsistent: the vendor says fixed in 4.5.0 and also lists it as affected. Use the newest firmware and confirm with GL.iNet.
Which products are affected?
A1300, AX1800, AXT1800, MT3000, MT2500, MT6000, MT1300, MT300N-V2, AR750S, AR750, AR300M and B1300.
Sources
Last reviewed: 19 October 2026.
