CVE-2023-49262

An attacker sends an HTTP request to the device with an intentionally overflowed value in the "authentication" Cookie field, causing an integer overflow error (CWE-190). As a result of this overflow, the authentication mechanism (CWE-287) is bypassed, provided that an active session of another user exists at that moment. This allows the attacker to access protected resources without knowledge of valid credentials.

An attacker can gain unauthorized access to the device management interface with full privileges, which may result in disclosure of sensitive configuration data, modification of network settings, or complete device takeover.

Patches available from the manufacturer should be applied according to the references. As additional remedial measures, it is recommended to restrict access to the device management interface solely to trusted networks and to monitor active user sessions.

Hongdian H8951-4G-Esp devices and Hongdian H8951-4G-Esp Firmware software — specific versions indicated in manufacturer references.