| शीर्षक | GL.iNet Router v4.8.1 unauthorized |
|---|
| विवरण | This vulnerability allows an unauthenticated attacker on the LAN side to directly access the /sdk/v1 endpoint exposed by the nginx proxy. The affected location block lacks the required OUI authentication directive (access_by_lua_file), causing requests to bypass the standard authentication logic. As a result, an attacker can invoke methods of the LPA (Local Profile Assistant) service without any credentials, cookie, or token. |
|---|
| स्रोत | ⚠️ https://github.com/gl-inet/CVE-issues/blob/main/4.0.0/Unauthenticated%20access%20to%20eSIM%20LPA%20API%20via%20nginx%20proxy%20bypass.md |
|---|
| उपयोगकर्ता | GLiNet (UID 96704) |
|---|
| सबमिशन | 05/06/2026 10:59 AM (2 महीनों पहले) |
|---|
| संयम | 02/08/2026 09:24 PM (2 months later) |
|---|
| स्थिति | स्वीकृत |
|---|
| VulDB प्रविष्टि | 385413 [GL.iNet E5800/E750/X2000/X3000/XE3000/XE300 तक 20260707 eSIM LPA API /sdk/v1 अधिकार वृद्धि] |
|---|
| अंक | 20 |
|---|