CVE-2023-50919: GL.iNet router NGINX authentication bypass via Lua pattern matching

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 20 September 2026. Confidence: high.

critical priorityCVSS 9.8 with no authentication or user interaction, a very high EPSS score, and public exploit material pointing to unauthenticated remote command execution make this an urgent fix for internet-exposed GL.iNet routers.

What it is

GL.iNet devices before firmware 4.5.0 contain an authentication bypass in the NGINX web interface caused by improper Lua string pattern matching. A remote, unauthenticated attacker can reach protected functionality without valid credentials, and the referenced Packet Storm material describes unauthenticated remote command execution on these routers.

Impact

An attacker gains full access to the device's web management interface without logging in, which the CVSS vector rates as high confidentiality, integrity and availability impact. The linked exploit write-up indicates this can extend to unauthenticated remote command execution on the router.

Attack surface

Reachable over the network through the NGINX web interface on affected GL.iNet routers; the CVSS vector shows no privileges and no user interaction required. Any device with the management interface exposed to an untrusted network is directly at risk.

Exploitation

Not listed in CISA KEV, but EPSS is 0.478 (98.8th percentile) and the vendor GitHub advisory and Packet Storm reference are tagged as exploit material, indicating public exploitation detail exists.

What to do

• Upgrade affected GL.iNet devices to firmware 4.5.0 or later, per the vendor advisory.
• If immediate upgrade is not possible, remove the router's web management interface from WAN exposure and restrict it to a trusted management network.
• Disable remote administration and any port forwarding that publishes the NGINX admin interface to the internet.
• Rotate administrative credentials and review device configuration for unauthorized changes after exposure.
• Monitor the vendor advisory page for updated firmware guidance for models still on 4.3.7 or 4.4.6.

Detection

• Review NGINX access logs on the router for requests to protected endpoints that return success without a preceding authenticated session.
• Alert on management interface requests originating from unexpected external or non-management source IPs.
• Hunt for unexpected processes, cron entries, or configuration changes on the device that would indicate post-exploitation command execution.
• Track firmware versions across the fleet and flag any device still running 4.3.7 or 4.4.6.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.