PT-2023-23350 · Gl.Inet · Gl.Inet

Published 2023-05-10 · Updated 2025-01-27 · CVE-2023-31471

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions GL.iNet devices versions prior to 3.216

Description An issue was discovered that allows the installation of arbitrary software, such as a reverse shell, through the software installation feature. This is possible because the restrictions on the available package list are limited to client-side verification, allowing software installation from the filesystem, the package list, or a URL.

Recommendations For versions prior to 3.216, as a temporary workaround, consider disabling the software installation feature until a patch is available. Restrict access to the software installation module to minimize the risk of exploitation. Avoid using the software installation feature to install software from untrusted sources, such as arbitrary URLs or unverified packages, until the issue is resolved.

Exploit

Fix

Related Identifiers

CVE-2023-31471

Affected Products

Gl.Inet

References · 6

• 🔥 https://github.com/gl-inet/CVE-issues/blob/main/3.215/Abuse_of_Functionality_leads_to_RCE.md · Exploit
• https://gl-inet.com · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2023-31471 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-31471 · Security Note
• https://t.me/cvenotify/108771 · Telegram Post
• https://t.me/cibsecurity/63762 · Telegram Post