CVE-2023-31473

CVSS 4.9 MEDIUMEPSS 3.9%CWE-77

Vexday Risk Score

13Baixo

Decisão SSVC (CISA)

Track

Sem sinal de exploração → monitorar

CVSS 4.9EPSS 3.9%KEV nãoPoC —Nuclei —Metasploit —Patch —

Ciclo de vida

11 mai 2023Publicada no NVD

Recomendação: Monitorar — sem sinal de exploração no momento.

An issue was discovered on GL.iNet devices before 3.216. There is an arbitrary file write in which an empty file can be created anywhere on the filesystem. This is caused by a command injection vulnerability with a filter applied. Through the software installation feature, it is possible to inject arbitrary parameters in a request to cause opkg to read an arbitrary file name while using root privileges. The -f option can be used with a configuration file.

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N

Produtos afetados

n/a · n/a

Quer saber se a sua infraestrutura está exposta a isto?

Falar com a TrueHacking →

Referências

https://github.com/gl-inet/CVE-issues/blob/main/3.215/Arbitrary_File_Read.md https://www.gl-inet.com