CVE-2023-31475

An issue was discovered on GL.iNet devices before 3.216. The function guci2_get() found in libglutil.so has a buffer overflow when an item is requested from a UCI context, and the value is pasted into a char pointer to a buffer without checking the size of the buffer.

• gl-inet gl-s20 firmware (< 3.216) • gl-inet gl-x3000 firmware (< 3.216) • gl-inet gl-mt3000 firmware (< 3.216) • gl-inet gl-mt2500 firmware (< 3.216) • gl-inet gl-mt2500a firmware (< 3.216) • gl-inet gl-axt1800 firmware (< 3.216) • gl-inet gl-a1300 firmware (< 3.216) • gl-inet gl-ax1800 firmware (< 3.216) • gl-inet gl-sft1200 firmware (< 3.216) • gl-inet gl-mt1300 firmware (< 3.216) • gl-inet gl-e750 firmware (< 3.216) • gl-inet gl-mv1000 firmware (< 3.216) • gl-inet gl-mv1000w firmware (< 3.216) • gl-inet gl-s10 firmware (< 3.216) • gl-inet gl-s200 firmware (< 3.216) • gl-inet gl-s1300 firmware (< 3.216) • gl-inet gl-sf1200 firmware (< 3.216) • gl-inet gl-b1300 firmware (< 3.216) • gl-inet gl-b2200 firmware (< 3.216) • gl-inet gl-ap1300 firmware (< 3.216) • gl-inet gl-ap1300lte firmware (< 3.216) • gl-inet gl-x1200 firmware (< 3.216) • gl-inet gl-x750 firmware (< 3.216) • gl-inet gl-x300b firmware (< 3.216) • gl-inet gl-xe300 firmware (< 3.216) • gl-inet gl-ar750s firmware (< 3.216) • gl-inet gl-ar750 firmware (< 3.216) • gl-inet gl-mifi firmware (< 3.216) • gl-inet gl-mt300n-v2 firmware (< 3.216) • gl-inet gl-ar300m firmware (< 3.216) • gl-inet gl-usb150 firmware (< 3.216) • gl-inet microuter-n300 firmware (< 3.216)