GL.iNet Authentication Bypass via SQL Injection in Username

Certain GL.iNet devices with 4.x firmware allow authentication bypass (resulting in administrative control of the device) via a username that is both a valid SQL statement and a valid regular expression. For example, this affects version 4.3.7 on GL-MT3000 GL-AR300M GL-B1300 GL-AX1800 GL-AR750S GL-MT2500 GL-AXT1800 GL-X3000 and GL-SFT1200.

Casky was already ahead

This CVE exploits attack patterns that Casky's 301matched skills already investigate — long before this vulnerability was disclosed. Claude's reasoning model maps these techniques to MITRE ATT&CK, so practitioners who ran these skills have already seen the threat behaviour in their findings.

Analysis

CVE-2023-46453 is a critical authentication bypass vulnerability affecting GL.iNet devices running 4.x firmware, including popular models like GL-MT3000, GL-AR300M, and GL-AX1800. The vulnerability exploits a dangerous input validation flaw where specially crafted usernames that function simultaneously as valid SQL statements and regular expressions allow unauthenticated attackers to gain full administrative control. With a CVSS score of 9.8, this represents a severe risk to organizations deploying GL.iNet devices for edge networking, VPN gateways, and remote access—particularly critical infrastructure and distributed workforces where these devices serve as security perimeters.

Casky's 301 mapped security skills detect the attack patterns underlying this vulnerability by analyzing initial access techniques (TA0001) and reconnaissance activities (TA0043) through Claude AI's extended reasoning capabilities. Practitioners using Casky would identify suspicious authentication attempts containing SQL metacharacters or regex operators in username fields, recognize anomalous privilege escalation following failed initial logins, and spot command execution patterns consistent with post-authentication administrative activity. The platform's SQL injection detection skills (CWE-89) would flag input validation failures, while behavioral analysis skills correlate rapid authentication retries with character pattern variations—the hallmark of attackers probing for SQL/regex payload acceptance. Security teams gain visibility into both the exploitation phase and lateral movement that follows successful bypass, enabling faster incident response and threat hunting across their GL.iNet device fleet.

Live Threat IntelligenceComing soon

Casky Risk Score

—

EPSS Probability

—

Shodan Exposure

—

GreyNoise Signal

—

Composite risk scoring from EPSS, CISA KEV, Shodan, and GreyNoise — 21 security APIs correlated into a single Casky Risk Score. Coming in Casky Pro. Join early access →

301 Casky skills cover this attack pattern

These skills use Claude AI's reasoning model to surface findings in the same attack categories as CVE-2023-46453.

analyzing-apt-group-with-mitre-navigator

threat intelligence · low

Run

analyzing-campaign-attribution-evidence

threat intelligence · low

Run

analyzing-certificate-transparency-for-phishing

threat intelligence · low

Run

MITRE ATT&CK Techniques

TA0001 TA0043

Investigate the attack patterns behind CVE-2023-46453

Casky has 301 skills that investigate the attack patterns behind CVE-2023-46453. Run one and get CVSS-scored findings in 3 minutes.

Run the skill that detects this →

X Instagram LinkedIn