CVE-2023-31474

GL.iNet devices before 3.216 are affected by CVE-2023-31474 due to a flaw in the software installation feature that lets an attacker inject arbitrary parameters via a regex in a package name, causing opkg to list files in a target directory. The issue stems from how package-name regex handling ca...

CVE-2023-31478

GL.iNet devices prior to firmware version 3.216 are affected by CVE-2023-31478. An API endpoint (mesh status) reveals Wi‑Fi configuration data, including SSID and password, potentially enabling unauthenticated access to the wireless network. The Nuclei template and related sources corroborate thi...

CVE-2023-31472

GL.iNet devices prior to 3.216 are affected by a command-injection–driven arbitrary file-write vulnerability that allows creating empty files anywhere on the filesystem. Root cause: an input filter failure enables unintended file writes via a crafted command. Impact: potential unauthorized file c...

CVE-2023-31471

The CVE-2023-31471 entry concerns GL.iNet devices prior to version 3.216. The issue arises via the software installation feature, where restrictions on the available package list are only client-side verified, allowing installation of arbitrary software (including a reverse shell) from the filesy...

CVE-2023-31477

CVE-2023-31477 is a path-traversal vulnerability in GL.iNet devices prior to 3.216. The flaw is in the file-sharing feature, which has no server-side restriction to limit sharing to the USB path, enabling sharing of arbitrary directories (e.g., /tmp, /etc). Impact described as exposing files via ...

CVE-2023-31473

Summary: CVE-2023-31473 affects GL.iNet devices prior to v3.216. A command-injection flaw with a filter allows an attacker to cause opkg to read an arbitrary file name as root, enabling arbitrary file write anywhere on the filesystem. This is possible through the software installation feature, wi...

CVE-2023-31475

GL.iNet devices prior to 3.216 are affected by a buffer overflow in libglutil.so: the guci2_get() function copies a UCI-context value into a buffer without checking size, potentially compromising confidentiality, integrity, and availability. Public sources (NVD/Red Hat) confirm the same issue and...

CVE-2023-24261

GL.iNET GL-E750 Mudi devices are affected by CVE-2023-24261. The vulnerability allows an authenticated attacker to execute arbitrary code via a crafted POST request, affecting firmware prior to v3.216. The cited details indicate network-exposed, authenticated code execution with high impact on co...