CVE-2023-50922 is a high severity code execution flaw in GL.iNet routers, scored 7.2. An attacker who has stolen the AdminToken cookie can run code through a crontab file upload. The vendor says it is fixed in 4.5.0, but also lists 4.5.0 as affected, so confirm the build.
What's affected
The record says GL.iNet devices through 4.5.0 are affected. It lists A1300, AX1800, AXT1800, MT3000 and MT2500 on 4.4.6, MT6000 on 4.5.0, and MT1300, MT300N-V2, AR750S, AR750, AR300M and B1300 on 4.3.7.
The vendor's page says the issue is fixed in 4.5.0 yet also lists 4.5.0 as affected, so the boundary is ambiguous. Check with GL.iNet before relying on 4.5.0 for your model.
NVD scores it 7.2 (High) with the vector CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H. High privileges are required, which matches the description: the attacker must already hold the administrator session token. The vendor page says an attacker who obtains the AdminToken cookie can place a crontab formatted file in a specific directory and the device runs it. The record was published on 2024-01-03.
How to check if you're exposed
Check the firmware version in the admin panel against the table above, and look for newer firmware from GL.iNet.
Then look at how the admin session could be stolen. Administrator cookies can be lost through cross site scripting, unencrypted access to the admin page, or malware on the administrator's computer. Check whether you reach the router admin page over HTTPS and from a trusted computer.
On the device, review scheduled jobs for entries you did not create.
What to do now
- Update the router to the newest firmware for your model.
- Confirm with GL.iNet that your build closes this issue.
- Use the admin page only over HTTPS and from trusted computers.
- Change the admin password and sign out of sessions you no longer need.
- Review scheduled tasks on the router for unknown entries.
Why it matters
The weakness is unrestricted file upload, CWE-434. The upload function accepts a file that the system later runs on a schedule. Anything that writes to a directory the scheduler reads is a code execution path.
The high privilege requirement lowers the risk compared with the unauthenticated flaws in the same firmware, but it does not remove it. Chained with a session theft or another bypass, it becomes a route to full control.
The record shows no CISA Known Exploited Vulnerabilities listing, and the vendor page does not report exploitation in the wild.
Quick check
Do I need to be logged in?
Yes. The vector requires high privileges and the description says the attacker needs the AdminToken cookie.
Is 4.5.0 the fix?
The vendor says so but also lists 4.5.0 as affected. Confirm with GL.iNet for your model.
Sources
Last reviewed: 19 October 2026.
