Lucene search

MitreCVE-2023-29778

HistoryMay 02, 2023 - 8:15 p.m.

CVE-2023-29778

2023-05-0220:15:10

CWE-78

mitre

web.nvd.nist.gov

cve-2023-29778

gl.inet

mt3000

os command injection

/usr/lib/oui-httpd/rpc/logread

CVSS3

9.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

AI Score

9.6

Confidence

High

EPSS

0.002

Percentile

61.9%

JSON

GL.iNET MT3000 4.1.0 Release 2 is vulnerable to OS Command Injection via /usr/lib/oui-httpd/rpc/logread.

Affected configurations

Nvd

Node

gl-inetgl-mt3000Match-

AND

gl-inetgl-mt3000_firmwareMatch4.1.0release_2

VendorProductVersionCPE
gl-inetgl-mt3000-cpe:2.3:h:gl-inet:gl-mt3000:-:*:*:*:*:*:*:*
gl-inetgl-mt3000_firmware4.1.0cpe:2.3:o:gl-inet:gl-mt3000_firmware:4.1.0:release_2:*:*:*:*:*:*

Vendor	Product	Version	CPE
gl-inet	gl-mt3000	-	cpe:2.3:h:gl-inet:gl-mt3000:-:::::::*
gl-inet	gl-mt3000_firmware	4.1.0	cpe:2.3:o:gl-inet:gl-mt3000_firmware:4.1.0:release_2::::::

References

glinet.com

github.com/OlivierLaflamme/cve/blob/main/GL.iNET/MT3000/get_nginx_log_RCE.md

CVSS3

9.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

AI Score

9.6

Confidence

High

EPSS

0.002

Percentile

61.9%

JSON

Related for CVE-2023-29778