CVE-2023-33620 in GL-AR750S-Ext
Summary
by MITRE • 06/13/2023
GL.iNET GL-AR750S-Ext firmware v3.215 uses an insecure protocol in its communications which allows attackers to eavesdrop via a man-in-the-middle attack.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 01/05/2026
The vulnerability identified as CVE-2023-33620 affects the GL.iNET GL-AR750S-Ext wireless router firmware version 3.215, representing a significant security weakness that compromises the integrity of network communications. This device operates as a dual-band wireless router designed for enterprise and industrial applications, making its security implications particularly concerning for organizations relying on secure network infrastructure. The vulnerability stems from the use of insecure communication protocols that fail to implement proper encryption mechanisms, creating an attack surface that adversaries can exploit to intercept sensitive data transmitted through the device.
The technical flaw manifests in the firmware's implementation of communication protocols that lack robust cryptographic protection, specifically failing to utilize secure transport layers such as TLS 1.3 or even TLS 1.2 with strong cipher suites. This insecure implementation allows attackers positioned within the network to perform man-in-the-middle attacks by intercepting and potentially modifying data flows between connected devices and network services. The vulnerability is classified under CWE-319 - Cleartext Transmission of Sensitive Information, which directly addresses the exposure of confidential data during transmission. The specific protocol weakness enables attackers to capture authentication credentials, sensitive configuration data, and other proprietary information that traverses the device's network interfaces.
The operational impact of this vulnerability extends beyond simple data interception, as it creates a persistent threat vector that can be exploited by both internal and external attackers. Organizations utilizing this firmware version face risks including unauthorized access to network resources, credential theft, and potential compromise of connected industrial control systems. The attack surface is particularly concerning for environments where the router serves as a gateway for critical infrastructure communications, as the vulnerability can facilitate lateral movement within networks and provide attackers with persistent access to sensitive systems. This weakness aligns with ATT&CK technique T1046 - Network Service Scanning and T1566 - Phishing, as attackers can leverage the compromised communication channel to establish further attack vectors.
Mitigation strategies for CVE-2023-33620 should prioritize immediate firmware updates from GL.iNET to address the insecure protocol implementation, though administrators must also implement network segmentation and monitoring to detect potential exploitation attempts. Network administrators should deploy intrusion detection systems capable of identifying anomalous traffic patterns that may indicate man-in-the-middle activity, while also ensuring that any sensitive data transmitted through the network utilizes end-to-end encryption regardless of the device's inherent security posture. The vulnerability highlights the critical importance of secure protocol implementation in network infrastructure devices and underscores the need for organizations to maintain current firmware versions and conduct regular security assessments of their network equipment. Organizations should also consider implementing network access controls and monitoring solutions that can detect and alert on suspicious communication patterns that may indicate exploitation of this vulnerability.