Links submitted by the Threat Radar community and AI curated for defenders.

Community Curated

NCSC UK

JVN Japan

GCP Compute Engine Security

GCP Kubernetes Security

AWS Security Bulletins

CERT/CC

Tenable Research

Google Project Zero

Microsoft Security Blog

Cisco Talos

Zero Day Initiative

Palo Alto Unit 42

Krebs on Security

Kaspersky Security Blog

Check Point Research

GCVE Database

CVE Database V5

AlienVault OTX General

Real-world exploitation and exposure telemetry from the OffSeq Mirage honeypot fleet and Sonar internet scans — which CVEs attackers are actually exploiting and which are exposed in the wild, plus attacker IoCs. All IPs are masked; no raw victim or sensor identity is ever published.

OffSeq Mirage

Bleeping Computer

SANS ISC Handlers Diary

SecurityWeek

Threatpost

Reddit ExploitDev

Latest exploits, shellcode, and vulnerability proofs-of-concept from Exploit-DB

Exploit-DB RSS Feed

Reddit ThreatIntel

Reddit BlueTeam

Reddit Reverse Engineering

Reddit Malware

Reddit Cybersecurity

Reddit NetSec

ThreatFox MISP Feed

CIRCL OSINT Feed

Reddit InfoSec News

The Hacker News

Dark Reading

AlienVault OTX Vulnerabilities

AlienVault OTX Malware

An issue was discovered on GL.iNet devices through 4.5.0. Attackers who are able to steal the AdminToken cookie can execute arbitrary code by uploading a crontab-formatted file to a specific directory and waiting for its execution. This affects A1300 4.4.6, AX1800 4.4.6, AXT1800 4.4.6, MT3000 4.4.6, MT2500 4.4.6, MT6000 4.5.0, MT1300 4.3.7, MT300N-V2 4.3.7, AR750S 4.3.7, AR750 4.3.7, AR300M 4.3.7, and B1300 4.3.7.

CVE-2023-50922 is a high-severity vulnerability affecting multiple GL.iNet router devices running firmware versions up to 4.5.0. The vulnerability arises from improper handling of uploaded files by the device's administrative interface. Specifically, if an attacker can obtain the AdminToken cookie—used for authenticating administrative sessions—they can upload a specially crafted file formatted as a crontab entry to a designated directory on the device. Because the system processes crontab files to schedule tasks, this malicious file will be executed by the system's cron daemon, allowing the attacker to execute arbitrary code with elevated privileges. This vulnerability affects a broad range of GL.iNet models, including A1300, AX1800, AXT1800, MT3000, MT2500, MT6000, MT1300, MT300N-V2, AR750S, AR750, AR300M, and B1300, across various firmware versions primarily in the 4.x series. The vulnerability is classified under CWE-434 (Unrestricted Upload of File with Dangerous Type), indicating that the device fails to properly restrict or sanitize uploaded files. The CVSS v3.1 base score is 7.2, reflecting a high impact on confidentiality, integrity, and availability, with network attack vector, low attack complexity, and requiring high privileges (possession of AdminToken cookie). No user interaction is needed once the token is obtained. Although no known exploits are currently reported in the wild, the vulnerability poses a significant risk due to the potential for remote code execution on network infrastructure devices. The lack of available patches at the time of reporting further increases the urgency for mitigation.

Detailed information about CVE-2023-50922: n/a in n/a affecting n/a n/a. Get real-time updates, technical details, and mitigation strategies.

CVE-2023-50922: n/a in n/a - Live Threat Intelligence - Threat Radar | OffSeq.com

CVE-2023-50922: n/a in n/a

Threats Tagged 'cve-2023-50922'

Stop chasing alerts. Route them.

Check if your credentials are on the dark web

Filter Threats

Threats Tagged 'cve-2023-50922'

Lead Pen Test Professional