CVE-2023-26494
Medium
Description
lorawan-stack is an open source LoRaWAN network server. Prior to version 3.24.1, an open redirect exists on the login page of the lorawan stack server, allowing an attacker to supply a user controlled redirect upon sign in. This issue may allows malicious actors to phish users, as users assume they were redirected to the homepage on login. Version 3.24.1 contains a fix.
SeverityMedium
CVSS6.1
Exploit probability—
ProductThethingsnetwork Lorawan-stack
PublishedApr 24, 2023
First seenApr 24, 2023
Weakness typeCWE-601Open redirect
How to fix
Update
- thethingsnetwork lorawan-stack3.24.1 or later
- go.thethings.network/lorawan-stack/v33.24.1 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| thethingsnetwork lorawan-stack | v < 3.24.1 | 3.24.1 |
| go.thethings.network/lorawan-stack/v3Go | v < 3.24.1 | 3.24.1 |
| go.thethings.network/lorawan-stackGo | No range specified | — |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.