PatchTheCVECVE-2023-49255: The router console is accessible without authentication at "data" field, and while a user needs to be logged i
CVE-2023-49255 is a critical-severity flaw (CVSS 9.8) affecting h8951-4g-esp firmware. Below: why it ranks where it does, which versions are affected, what to do, and the exact commands.
The router console is accessible without authentication at "data" field, and while a user needs to be logged in in order to modify the configuration, the session state is shared. If any other user is currently logged in, the anonymous user can execute commands in the context of the authenticated one. If the logged in user has administrative privileges, it is possible to use webadmin service configuration commands to create a new admin user with a
Why this priority
- Critical severity
- Remotely exploitable, no login, no user action
A fixed release or distro patch exists.
Risk facts
| CVSS score | 9.8 (Critical) |
| Attack vector | Network (remote) |
| Attack complexity | Low |
| Privileges needed | None |
| User interaction | None |
| EPSS exploit chance | 0.7% (top 46%) |
| CISA exploited list | No |
| Weakness | CWE-306 |
| Published | 2024-01-12 |
| Last modified | 2026-06-17 |
Last updated 2026-06-17 · Sources: CVE Program, NVD, CISA KEV, EPSS and vendor advisories · How we score
Am I affected?
Timeline
- Published CVE record published
- Updated Record last modified
Scores and fixes here are computed automatically from those and other public sources. Confirm with the vendor advisory before changing production systems.
Quick answers
How do I fix CVE-2023-49255?
h8951-4g-esp firmware: upgrade to 2310271149. Exact commands for each OS are on this page.
Is CVE-2023-49255 being exploited?
CVE-2023-49255 is not on the CISA Known Exploited Vulnerabilities list at the time of the last update. Check again, as this can change.
What does CVE-2023-49255 affect?
CVE-2023-49255 affects h8951-4g-esp firmware. Severity is critical (CVSS 9.8). The router console is accessible without authentication at "data" field, and while a user needs to be logged in in order to modify the configuration, the session state is shared. If any other user is currently logged in, the anonymous user
How urgent is CVE-2023-49255?
Priority 53/100. Critical severity; Remotely exploitable, no login, no user action
Related CVEs
- CVE-2023-49262 CRITICAL 9.8 UPGRADE The authentication mechanism can be bypassed by overflowing the value of the Cookie "authentication" field, pr
- CVE-2023-49261 HIGH 7.5 UPGRADE The "tokenKey" value used in user authorization is visible in the HTML source of the login page.
- CVE-2023-49260 MEDIUM 6.1 UPGRADE An XSS attack can be performed by changing the MOTD banner and pointing the victim to the "terminal_tool.cgi"
- CVE-2023-49259 HIGH 7.5 UPGRADE The authentication cookies are generated using an algorithm based on the username, hardcoded secret and the up
- CVE-2023-49258 MEDIUM 6.1 UPGRADE User browser may be forced to execute JavaScript and pass the authentication cookie to the attacker leveraging