Lucene search

[email protected]NVD:CVE-2023-50445

HistoryDec 28, 2023 - 5:15 a.m.

CVE-2023-50445

2023-12-2805:15:08

CWE-78

CWE-77

[email protected]

web.nvd.nist.gov

cve-2023-50445

gl.inet

shell injection

a1300

ax1800

axt1800

mt3000

mt2500

mt6000

mt1300

mt300n-v2

ar750s

ar750

ar300m

b1300

local attackers

arbitrary code

logread module

upgrade module

CVSS3

7.8

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

EPSS

Percentile

5.2%

JSON

Shell Injection vulnerability GL.iNet A1300 v4.4.6, AX1800 v4.4.6, AXT1800 v4.4.6, MT3000 v4.4.6, MT2500 v4.4.6, MT6000 v4.5.0, MT1300 v4.3.7, MT300N-V2 v4.3.7, AR750S v4.3.7, AR750 v4.3.7, AR300M v4.3.7, and B1300 v4.3.7., allows local attackers to execute arbitrary code via the get_system_log and get_crash_log functions of the logread module, as well as the upgrade_online function of the upgrade module.

Affected configurations

Nvd

Node

gl-inetgl-mt1300Match-

AND

gl-inetgl-mt1300_firmwareMatch4.3.7

Node

gl-inetgl-mt300n-v2Match-

AND

gl-inetgl-mt300n-v2_firmwareMatch4.3.7

Node

gl-inetgl-ar750sMatch-

AND

gl-inetgl-ar750s_firmwareMatch4.3.7

Node

gl-inetgl-ar750Match-

AND

gl-inetgl-ar750_firmwareMatch4.3.7

Node

gl-inetgl-ar300mMatch-

AND

gl-inetgl-ar300m_firmwareMatch4.3.7

Node

gl-inetgl-b1300Match-

AND

gl-inetgl-b1300_firmwareMatch4.3.7

Node

gl-inetgl-mt6000Match-

AND

gl-inetgl-mt6000_firmwareMatch4.5.0

Node

gl-inetgl-a1300_firmwareMatch4.4.6

AND

gl-inetgl-a1300Match-

Node

gl-inetgl-ax1800_firmwareMatch4.4.6

AND

gl-inetgl-ax1800Match-

Node

gl-inetgl-axt1800_firmwareMatch4.4.6

AND

gl-inetgl-axt1800Match-

Node

gl-inetgl-mt3000_firmwareMatch4.4.6

AND

gl-inetgl-mt3000Match-

Node

gl-inetgl-mt2500_firmwareMatch4.4.6

AND

gl-inetgl-mt2500Match-

References

packetstormsecurity.com/files/176708/GL.iNet-Unauthenticated-Remote-Command-Execution.html

github.com/gl-inet/CVE-issues/blob/main/4.0.0/Using%20Shell%20Metacharacter%20Injection%20via%20API.md

CVSS3

7.8

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

EPSS

Percentile

5.2%

JSON

Related for NVD:CVE-2023-50445

prion1 vulnrichment1 cvelist1 cve1 packetstorm1 metasploit1 zdt1 rapid7blog1