Vulnerability Description
An issue was discovered on GL.iNet devices before 3.216. There is an arbitrary file write in which an empty file can be created anywhere on the filesystem. This is caused by a command injection vulnerability with a filter applied. Through the software installation feature, it is possible to inject arbitrary parameters in a request to cause opkg to read an arbitrary file name while using root privileges. The -f option can be used with a configuration file.
CVSS Score
MEDIUM
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Gl-Inet | Gl-S20 Firmware | < 3.216 |
| Gl-Inet | Gl-S20 | - |
| Gl-Inet | Gl-X3000 Firmware | < 3.216 |
| Gl-Inet | Gl-X3000 | - |
| Gl-Inet | Gl-Mt3000 Firmware | < 3.216 |
| Gl-Inet | Gl-Mt3000 | - |
| Gl-Inet | Gl-Mt2500 Firmware | < 3.216 |
| Gl-Inet | Gl-Mt2500 | - |
| Gl-Inet | Gl-Mt2500A Firmware | < 3.216 |
| Gl-Inet | Gl-Mt2500A | - |
| Gl-Inet | Gl-Axt1800 Firmware | < 3.216 |
| Gl-Inet | Gl-Axt1800 | - |
| Gl-Inet | Gl-A1300 Firmware | < 3.216 |
| Gl-Inet | Gl-A1300 | - |
| Gl-Inet | Gl-Ax1800 Firmware | < 3.216 |
| Gl-Inet | Gl-Ax1800 | - |
| Gl-Inet | Gl-Sft1200 Firmware | < 3.216 |
| Gl-Inet | Gl-Sft1200 | - |
| Gl-Inet | Gl-Mt1300 Firmware | < 3.216 |
| Gl-Inet | Gl-Mt1300 | - |
Related Weaknesses (CWE)
References
- https://github.com/gl-inet/CVE-issues/blob/main/3.215/Arbitrary_File_Read.mdExploitThird Party Advisory
- https://www.gl-inet.comVendor Advisory
- https://github.com/gl-inet/CVE-issues/blob/main/3.215/Arbitrary_File_Read.mdExploitThird Party Advisory
- https://www.gl-inet.comVendor Advisory
FAQ
What is CVE-2023-31473?
CVE-2023-31473 is a vulnerability with a CVSS score of 4.9 (MEDIUM). An issue was discovered on GL.iNet devices before 3.216. There is an arbitrary file write in which an empty file can be created anywhere on the filesystem. This is caused by a command injection vulner...
How severe is CVE-2023-31473?
CVE-2023-31473 has been rated MEDIUM with a CVSS base score of 4.9/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2023-31473?
Check the references section above for vendor advisories and patch information. Affected products include: Gl-Inet Gl-S20 Firmware, Gl-Inet Gl-S20, Gl-Inet Gl-X3000 Firmware, Gl-Inet Gl-X3000, Gl-Inet Gl-Mt3000 Firmware.