CVE-2023-38946
📋 TL;DR
This vulnerability allows attackers to bypass authentication in Multilaser RE160 routers by supplying a specially crafted cookie, granting them complete administrative access to the web interface. It affects users of Multilaser RE160 routers running specific vulnerable firmware versions. Attackers can exploit this remotely without valid credentials.
💻 Affected Systems
- Multilaser RE160 Router
📦 What is this software?
Re160 Firmware by Multilaser
Re160 Firmware by Multilaser
⚠️ Risk & Real-World Impact
Worst Case
Complete compromise of router administration, allowing attackers to change network settings, intercept traffic, install malicious firmware, or use the router as a pivot point into the internal network.
Likely Case
Unauthorized access to router configuration, enabling attackers to change DNS settings, redirect traffic, or disable security features.
If Mitigated
Limited impact if router is behind additional firewalls, has restricted administrative access, or uses strong network segmentation.
🎯 Exploit Status
The exploit involves crafting a specific cookie value to bypass authentication checks. Details are publicly available in the referenced disclosures.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: Not available
Restart Required: No
Instructions:
No official patch is currently available. Monitor Multilaser's website for firmware updates addressing CVE-2023-38946.
🔧 Temporary Workarounds
Disable Remote Administration
allPrevent external access to the router's web interface by disabling remote administration features.
Access router admin panel > Advanced Settings > Remote Management > Disable
Change Default Admin Credentials
allWhile this doesn't fix the vulnerability, it adds an additional layer of security in case other authentication mechanisms are compromised.
Access router admin panel > System Tools > Change Password
🧯 If You Can't Patch
- Segment the router on a dedicated network VLAN to limit lateral movement if compromised.
- Implement network monitoring to detect unusual administrative access patterns or configuration changes.
🔍 How to Verify
Check if Vulnerable:
Check router firmware version via admin interface: Login > Status > Firmware Version. If version is v5.07.51_pt_MTL01 or v5.07.52_pt_MTL01, the device is vulnerable.Check Version:
Not applicable - check via web interface at http://router_ip/status.aspVerify Fix Applied:
Verify firmware has been updated to a version later than v5.07.52_pt_MTL01. Test authentication bypass by attempting to access admin pages without valid credentials.📡 Detection & Monitoring
Log Indicators:
- Successful admin logins from unusual IP addresses
- Configuration changes without corresponding legitimate admin activity
- Failed authentication attempts followed by successful access
Network Indicators:
- HTTP requests to admin pages with crafted cookie values
- Unusual outbound traffic from router suggesting compromise
SIEM Query:
http.url:"/admin/*" AND http.cookie:"*crafted_value*" OR event.action:"configuration_change" AND device.vendor:"Multilaser" AND device.model:"RE160"