PT-2023-23352 · Gl.Inet · Gl.Inet

Publicado 2023-05-11 · Atualizado 2023-05-22 · CVE-2023-31473

Positive Technologies (AI Summary)

CVSS v3.1

4.9

Média

Vetor base

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions GL.iNet devices versions prior to 3.216

Description An issue was discovered that allows for arbitrary file write, where an empty file can be created anywhere on the filesystem. This is caused by a command injection vulnerability with a filter applied, allowing an attacker to inject arbitrary parameters through the software installation feature. This can cause opkg to read an arbitrary file name while using root privileges, potentially using the -f option with a configuration file.

Recommendations For versions prior to 3.216, update to version 3.216 or later to resolve the issue. As a temporary workaround, consider restricting the use of the software installation feature to minimize the risk of exploitation. Avoid using the opkg command with the -f option and a configuration file until the issue is resolved.

Exploit

Correção

Command Injection

Enumeração de Fraquezas

CWE-77

Identificadores relacionados

CVE-2023-31473

Produtos afetados

Gl.Inet

Referências · 4

• 🔥 https://github.com/gl-inet/CVE-issues/blob/main/3.215/Arbitrary_File_Read.md · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2023-31473 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2023-31473 · Aviso do Fabricante
• https://gl-inet.com · Aviso do Fabricante