External risk intelligence

Unionman Jlink AX1800 Authentication Bypass Remote Code Execution.

CVE advisorySeverity: CRITICAL (CVSS 9.8)

CVE-2023-37057

The vulnerability exists in a consumer router's authentication mechanism. Routers are designed to serve as the internet edge gateway for networks, making their management interfaces or authentication services frequently accessible or intended to be accessible from the network, including the public internet in many deployment scenarios.

Halo Surface Signal: 5 out of 5 — more likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

An issue has been identified in Unionman Technology Co. Ltd Jlink AX1800 devices that could allow an unauthorized remote attacker to run their own code on the device. This type of vulnerability, if exploited, could potentially impact network security and device integrity. The main concern at this stage is confirming if these devices are in use within our environment and if so, understanding the scope of exposure.

Remote code execution vulnerability found.
Affects network edge devices.
Confirm relevance and exposure.

Attack Path

How an attacker could exploit the issue

A remote attacker could exploit this vulnerability by targeting the router's authentication mechanism. Once accessed, the attacker may be able to execute arbitrary code, potentially leading to a compromise of the device.

No authentication required for access.
Exploits router authentication mechanism.
Allows arbitrary code execution.

Live Threat

Current exploitation, exposure, and threat context

This vulnerability could allow an unauthenticated remote attacker to execute arbitrary code on the affected router through its authentication mechanism. This could lead to a compromise of the device and its network traffic.

Router code execution.
Exploits authentication mechanism.
Compromises device and network.

Operational Fix

Recommended remediation, mitigation, and detection steps

System administrators and infrastructure teams are likely responsible for managing and securing the JLINK AX1800 router. The first practical step is to identify all instances of this router within the environment, determine their network exposure, and confirm business criticality to prioritize remediation efforts.

Infrastructure teams own the issue.
Verify external reachability and criticality.
Plan remediation based on risk.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is the Unionman Jlink AX1800 router?

The Jlink AX1800 is a networking device manufactured by Unionman Technology Co. Ltd. It acts as an internet gateway, managing and routing traffic between local connected devices and the public internet. Because it sits at the network edge, it performs critical functions like handling incoming connection requests and authenticating administrative access to manage network settings.

How does CVE-2023-37057 allow unauthorized code execution?

This vulnerability is classified as CWE-288, which refers to an authentication bypass weakness. Essentially, the router's login process contains a flaw that allows an attacker to interact with the device without providing valid credentials. By successfully skipping the authentication step, an attacker can bypass security checks to execute arbitrary code directly on the router's operating system.

Do I need to be authenticated to trigger this flaw?

No. The vulnerability exists specifically because the router fails to properly enforce authentication requirements. An attacker can initiate the attack remotely without needing a username or password. Note that this flaw targets the router's management authentication mechanism; actions taken on the network side or typical user traffic that does not interact with the router's administrative authentication would not trigger this specific vulnerability.

Is my device at risk based on Halo Surface Signal?

Halo Surface Signal indicates that this device is a consumer router designed to act as an internet edge gateway. Because these devices are frequently deployed in configurations where management interfaces are accessible via the public internet, there is a high likelihood that affected units are exposed to remote, unauthenticated access attempts from external sources.

What should I do if I use Jlink AX1800 routers?

Your first step is to locate all Jlink AX1800 devices currently in use across your environment. Once identified, evaluate their network placement to determine if they are reachable from outside your local network. Document their role and business importance so your team can prioritize securing or replacing these units while monitoring for official security guidance from the manufacturer.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.