CVE-2023-24052

The password change function in Connectize AC21000 G6 firmware version 641.139.1.1256 does not verify user identity by requiring entry of the current password before changing it. An attacker can send a password change request without knowing the current administrative password, resulting in full control takeover of the device. The vulnerability is classified as improper authorization (CWE-863), as the system does not enforce proper access control for critical operations.

An attacker can gain full administrative control over the router by changing the access password without knowing the current authentication credentials. Consequences may include loss of access by the legitimate administrator, modification of network configuration, and potential exposure of the entire network infrastructure served by the device.

Apply patches available from the manufacturer according to the references. Additionally, it is recommended to restrict access to the device's administrative panel exclusively to trusted IP addresses and isolate the management interface from the public network.

Connectize AC21000 G6 with firmware version 641.139.1.1256