Lucene search

[email protected]CVE-2023-31471

HistoryMay 10, 2023 - 3:15 p.m.

CVE-2023-31471

2023-05-1015:15:10

[email protected]

web.nvd.nist.gov

gl.inet

cve-2023-31471

nvd

vulnerability

security issue

software installation

reverse shell

9.8 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

9.4 High

AI Score

Confidence

High

0.003 Low

EPSS

Percentile

65.9%

JSON

An issue was discovered on GL.iNet devices before 3.216. Through the software installation feature, it is possible to install arbitrary software, such as a reverse shell, because the restrictions on the available package list are limited to client-side verification. It is possible to install software from the filesystem, the package list, or a URL.

Affected configurations

NVD

Node

gl-inetgl-s20_firmwareRange<3.216

AND

gl-inetgl-s20Match-

Node

gl-inetgl-x3000_firmwareRange<3.216

AND

gl-inetgl-x3000Match-

Node

gl-inetgl-mt3000_firmwareRange<3.216

AND

gl-inetgl-mt3000Match-

Node

gl-inetgl-mt2500_firmwareRange<3.216

AND

gl-inetgl-mt2500Match-

Node

gl-inetgl-mt2500a_firmwareRange<3.216

AND

gl-inetgl-mt2500aMatch-

Node

gl-inetgl-axt1800_firmwareRange<3.216

AND

gl-inetgl-axt1800Match-

Node

gl-inetgl-a1300_firmwareRange<3.216

AND

gl-inetgl-a1300Match-

Node

gl-inetgl-ax1800_firmwareRange<3.216

AND

gl-inetgl-ax1800Match-

Node

gl-inetgl-sft1200_firmwareRange<3.216

AND

gl-inetgl-sft1200Match-

Node

gl-inetgl-mt1300_firmwareRange<3.216

AND

gl-inetgl-mt1300Match-

Node

gl-inetgl-e750_firmwareRange<3.216

AND

gl-inetgl-e750Match-

Node

gl-inetgl-mv1000_firmwareRange<3.216

AND

gl-inetgl-mv1000Match-

Node

gl-inetgl-mv1000w_firmwareRange<3.216

AND

gl-inetgl-mv1000wMatch-

Node

gl-inetgl-s10_firmwareRange<3.216

AND

gl-inetgl-s10Match-

Node

gl-inetgl-s200_firmwareRange<3.216

AND

gl-inetgl-s200Match-

Node

gl-inetgl-s1300_firmwareRange<3.216

AND

gl-inetgl-s1300Match-

Node

gl-inetgl-sf1200_firmwareRange<3.216

AND

gl-inetgl-sf1200Match-

Node

gl-inetgl-b1300_firmwareRange<3.216

AND

gl-inetgl-b1300Match-

Node

gl-inetgl-b2200Match-

AND

gl-inetgl-b2200_firmwareRange<3.216

Node

gl-inetgl-ap1300Match-

AND

gl-inetgl-ap1300_firmwareRange<3.216

Node

gl-inetgl-ap1300lte_firmwareRange<3.216

AND

gl-inetgl-ap1300lteMatch-

Node

gl-inetgl-x1200_firmwareRange<3.216

AND

gl-inetgl-x1200Match-

Node

gl-inetgl-x750_firmwareRange<3.216

AND

gl-inetgl-x750Match-

Node

gl-inetgl-x300b_firmwareRange<3.216

AND

gl-inetgl-x300bMatch-

Node

gl-inetgl-xe300Match-

AND

gl-inetgl-xe300_firmwareRange<3.216

Node

gl-inetgl-ar750sMatch-

AND

gl-inetgl-ar750s_firmwareRange<3.216

Node

gl-inetgl-ar750Match-

AND

gl-inetgl-ar750_firmwareRange<3.216

Node

gl-inetgl-mifiMatch-

AND

gl-inetgl-mifi_firmwareRange<3.216

Node

gl-inetgl-mt300n-v2Match-

AND

gl-inetgl-mt300n-v2_firmwareRange<3.216

Node

gl-inetgl-ar300mMatch-

AND

gl-inetgl-ar300m_firmwareRange<3.216

Node

gl-inetgl-usb150_firmwareRange<3.216

AND

gl-inetgl-usb150Match-

Node

gl-inetmicrouter-n300_firmwareRange<3.216

AND

gl-inetmicrouter-n300Match-

CPENameOperatorVersion
gl-inet:gl-s20_firmwaregl-inet gl-s20 firmwarelt3.216

CPE	Name	Operator	Version
gl-inet:gl-s20_firmware	gl-inet gl-s20 firmware	lt	3.216

References

github.com/gl-inet/CVE-issues/blob/main/3.215/Abuse_of_Functionality_leads_to_RCE.md

www.gl-inet.com

9.8 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

9.4 High

AI Score

Confidence

High

0.003 Low

EPSS

Percentile

65.9%

JSON

Related for CVE-2023-31471

nvd1 prion1 cvelist1