CVE-2023-24051

The login attempt rate limiting mechanism is implemented solely on the client side, which means it can be easily bypassed by sending requests directly to the device, bypassing the web interface. An attacker can thus conduct a brute force attack on authentication credentials without any attempt limitation. The lack of effective server-side protection classifies the vulnerability according to CWE-307 (insufficient authentication attempt limitation) and CWE-863 (improper authorization).

An attacker can guess login credentials and obtain elevated privileges (privilege escalation) on the device, which consequently may result in complete takeover of the router, including the ability to modify network configuration, intercept network traffic, or further attack devices on the local network.

Apply patches available from the manufacturer according to references. Additionally, it is recommended to use strong, unique passwords for the administrative panel and restrict access to the management interface only to trusted IP addresses or local network (e.g., through firewall or ACL).

Connectize AC21000 G6 with firmware version 641.139.1.1256