CVE-2023-49255

The vulnerability results from the lack of authentication enforcement (CWE-306) for the router console's "data" endpoint. Session state is shared between users — if any user is logged in at the same time, an anonymous attacker can execute commands in the context of that session. When the active session belongs to an administrator, the attacker can use webadmin service configuration commands to create a new administrator account with an arbitrarily chosen password.

A remote, unauthenticated attacker can take full administrative control of the router by creating a new administrator account, resulting in complete breach of confidentiality, integrity, and availability of the device.

Apply patches available from the manufacturer according to the references. Additionally, it is recommended to restrict network access to the router's management interface only to trusted IP addresses and to monitor unauthorized access attempts to the console.

Hongdian H8951-4G-Esp Firmware and Hongdian H8951-4G-Esp devices; specific versions indicated in manufacturer references