CVE-2023-41351: Chunghwa Telecom NOKIA G-040W-Q - Broken Access Control

Severity: critical (CVSS 9.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.8% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2023-11-03 · updated 2026-06-17
Weakness: CWE-288

Description

Chunghwa Telecom NOKIA G-040W-Q has a vulnerability of authentication bypass, which allows an unauthenticated remote attacker to bypass the authentication mechanism to log in to the device by an alternative URL. This makes it possible for unauthenticated remote attackers to log in as any existing users, such as an administrator, to perform arbitrary system operations or disrupt service.

Affected products

Chunghwa Telecom NOKIA G-040W-Q: g040wqr201207

References

https://www.twcert.org.tw/tw/cp-132-7501-6155a-1.html
https://www.twcert.org.tw/tw/cp-132-7501-6155a-1.html

Get alerted when CVE-2023-41351 or the next vulnerability affects your stack