Executive Summary

This vulnerability exists in the LuCI web interface on Gl Inet GL.Inet AX1800 versions 4.6.4 and 4.6.8. The issue is that these versions lack rate limiting or account lockout mechanisms on the authentication endpoint (/cgi-bin/luci). This allows an unauthenticated attacker on the local network to perform unlimited password attempts against the admin interface, potentially enabling brute-force attacks.

Useful 0 Not Useful 0

Impact Analysis

The vulnerability can allow an attacker on the local network to repeatedly attempt to guess the admin password without restriction. This could lead to unauthorized access to the device's administrative interface, potentially compromising the device's security and control.

Useful 0 Not Useful 0

Mitigation Strategies

Upgrade the GL.Inet AX1800 device firmware to version 4.8.2 or later, which contains the fix for this vulnerability. Until the upgrade is applied, restrict local network access to the authentication endpoint (/cgi-bin/luci) to trusted users only, and monitor for unusual authentication attempts to prevent brute-force attacks.

Useful 0 Not Useful 0