PT-2023-23355 · Gl.Inet · Gl.Inet

Published 2023-05-09 · Updated 2023-05-16 · CVE-2023-31476

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions GL.iNet devices running firmware prior to 3.216

Description An issue allows for arbitrary file write, enabling the creation of an empty file almost anywhere on the filesystem, given that the filename and path are no more than 6 characters. The working directory for this issue is /www.

Recommendations For GL.iNet devices running firmware prior to 3.216, update to firmware version 3.216 or later to resolve the issue. As a temporary workaround, consider restricting write access to sensitive areas of the filesystem to minimize the risk of exploitation.

Exploit

Fix

Command Injection

Weakness Enumeration

CWE-77

Related Identifiers

CVE-2023-31476

Affected Products

Gl.Inet

References · 5

• 🔥 https://github.com/gl-inet/CVE-issues/blob/main/3.215/GL-MV1000_Arbitrary_File_Creation.md · Exploit
• https://osv.dev/vulnerability/CVE-2023-31476 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-31476 · Security Note
• https://gl-inet.com · Note
• https://t.me/cvenotify/50037 · Telegram Post