CVE-2023-31473

An issue was discovered on GL.iNet devices before 3.216. There is an arbitrary file write in which an empty file can be created anywhere on the filesystem. This is caused by a command injection vulnerability with a filter applied. Through the software installation feature, it is possible to inject arbitrary parameters in a request to cause opkg to read an arbitrary file name while using root privileges. The -f option can be used with a configuration file.

• gl-inet gl-s20 firmware (< 3.216) • gl-inet gl-x3000 firmware (< 3.216) • gl-inet gl-mt3000 firmware (< 3.216) • gl-inet gl-mt2500 firmware (< 3.216) • gl-inet gl-mt2500a firmware (< 3.216) • gl-inet gl-axt1800 firmware (< 3.216) • gl-inet gl-a1300 firmware (< 3.216) • gl-inet gl-ax1800 firmware (< 3.216) • gl-inet gl-sft1200 firmware (< 3.216) • gl-inet gl-mt1300 firmware (< 3.216) • gl-inet gl-e750 firmware (< 3.216) • gl-inet gl-mv1000 firmware (< 3.216) • gl-inet gl-mv1000w firmware (< 3.216) • gl-inet gl-s10 firmware (< 3.216) • gl-inet gl-s200 firmware (< 3.216) • gl-inet gl-s1300 firmware (< 3.216) • gl-inet gl-sf1200 firmware (< 3.216) • gl-inet gl-b1300 firmware (< 3.216) • gl-inet gl-b2200 firmware (< 3.216) • gl-inet gl-ap1300 firmware (< 3.216) • gl-inet gl-ap1300lte firmware (< 3.216) • gl-inet gl-x1200 firmware (< 3.216) • gl-inet gl-x750 firmware (< 3.216) • gl-inet gl-x300b firmware (< 3.216) • gl-inet gl-xe300 firmware (< 3.216) • gl-inet gl-ar750s firmware (< 3.216) • gl-inet gl-ar750 firmware (< 3.216) • gl-inet gl-mifi firmware (< 3.216) • gl-inet gl-mt300n-v2 firmware (< 3.216) • gl-inet gl-ar300m firmware (< 3.216) • gl-inet gl-usb150 firmware (< 3.216) • gl-inet microuter-n300 firmware (< 3.216)