Lucene search

PRIOn knowledge basePRION:CVE-2023-50445

HistoryDec 28, 2023 - 5:15 a.m.

Sql injection

2023-12-2805:15:00

PRIOn knowledge base

www.prio-n.com

shell injection

gl.inet

vulnerability

arbitrary code

local attackers

security issue

logread module

upgrade module.

7.8 High

CVSS3

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

8.1 High

AI Score

Confidence

High

4.3 Medium

CVSS2

Access Vector

LOCAL

Access Complexity

LOW

Authentication

SINGLE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:L/AC:L/Au:S/C:P/I:P/A:P

0.0004 Low

EPSS

Percentile

5.5%

JSON

Shell Injection vulnerability GL.iNet A1300 v4.4.6, AX1800 v4.4.6, AXT1800 v4.4.6, MT3000 v4.4.6, MT2500 v4.4.6, MT6000 v4.5.0, MT1300 v4.3.7, MT300N-V2 v4.3.7, AR750S v4.3.7, AR750 v4.3.7, AR300M v4.3.7, and B1300 v4.3.7., allows local attackers to execute arbitrary code via the get_system_log and get_crash_log functions of the logread module, as well as the upgrade_online function of the upgrade module.

CPENameOperatorVersion
gl-a1300_firmwareeq4.4.6
gl-ar300m_firmwareeq4.3.7
gl-ar750_firmwareeq4.3.7
gl-ar750s_firmwareeq4.3.7
gl-ax1800_firmwareeq4.4.6
gl-axt1800_firmwareeq4.4.6
gl-b1300_firmwareeq4.3.7
gl-mt1300_firmwareeq4.3.7
gl-mt2500_firmwareeq4.4.6
gl-mt3000_firmwareeq4.4.6

Name	Operator	Version
gl-a1300_firmware	eq	4.4.6
gl-ar300m_firmware	eq	4.3.7
gl-ar750_firmware	eq	4.3.7
gl-ar750s_firmware	eq	4.3.7
gl-ax1800_firmware	eq	4.4.6
gl-axt1800_firmware	eq	4.4.6
gl-b1300_firmware	eq	4.3.7
gl-mt1300_firmware	eq	4.3.7
gl-mt2500_firmware	eq	4.4.6
gl-mt3000_firmware	eq	4.4.6

Rows per page:

1-10 of 121

References

packetstormsecurity.com/files/176708/GL.iNet-Unauthenticated-Remote-Command-Execution.html

github.com/gl-inet/CVE-issues/blob/main/4.0.0/Using%20Shell%20Metacharacter%20Injection%20via%20API.md

7.8 High

CVSS3

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

8.1 High

AI Score

Confidence

High

4.3 Medium

CVSS2

Access Vector

LOCAL

Access Complexity

LOW

Authentication

SINGLE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:L/AC:L/Au:S/C:P/I:P/A:P

0.0004 Low

EPSS

Percentile

5.5%

JSON

Related for PRION:CVE-2023-50445