CVE-2023-30403

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

An issue in the time-based authentication mechanism of Aigital Aigital Wireless-N Repeater Mini_Router v0.131229 allows attackers to bypass login by connecting to the web app after a successful attempt by a legitimate user.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Weakness enumeration

CWE-613

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

https://dl.packetstormsecurity.net/2305-exploits/aigitalwnr-bypass.txtBroken Link
https://mandomat.github.io/2023-04-13-testing-a-cheap-wifi-repeater/Exploit, Third Party Advisory
https://dl.packetstormsecurity.net/2305-exploits/aigitalwnr-bypass.txtBroken Link
https://mandomat.github.io/2023-04-13-testing-a-cheap-wifi-repeater/Exploit, Third Party Advisory

Timeline

Published: May 2, 2023
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2023

CVE-2023-304049.8Aigital Wireless-N Repeater Mini_Router v0.131229 was discovered to contain a remote code execution (RCE) vulnerability via the sysCmd param CVE-2023-304055.4A cross-site scripting (XSS) vulnerability in Aigital Wireless-N Repeater Mini_Router v0.131229 allows attackers to execute arbitrary web sc CVE-2023-304065.5Jerryscript commit 1a2c047 was discovered to contain a segmentation violation via the component ecma_find_named_property at /base/ecma-helpe CVE-2023-304085.5Jerryscript commit 1a2c047 was discovered to contain a segmentation violation via the component build/bin/jerry.CVE-2023-30416.1The Autochat Automatic Conversation WordPress plugin through 1.1.7 does not sanitise and escape user input before outputting it back on the CVE-2023-304105.5Jerryscript commit 1a2c047 was discovered to contain a stack overflow via the component ecma_op_function_construct at /operations/ecma-funct CVE-2023-304145.5Jerryscript commit 1a2c047 was discovered to contain a stack overflow via the component vm_loop at /jerry-core/vm/vm.c.CVE-2023-304159.8Sourcecodester Packers and Movers Management System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /in CVE-2023-304175.4A cross-site scripting (XSS) vulnerability in Pear-Admin-Boot up to v2.0.2 allows attackers to execute arbitrary web scripts or HTML via a c CVE-2023-30426.1In dotCMS, versions mentioned, a flaw in the NormalizationFilter does not strip double slashes (//) from URLs, potentially enabling bypasses CVE-2023-304212.9mystrtod in mjson 1.2.7 requires more than a billion iterations during processing of certain digit strings such as 8891110122900e91301393575 CVE-2023-304288.1Incorrect Authorization vulnerability in Apache Software Foundation Apache Pulsar Broker's Rest Producer allows authenticated user with a cu