medium6.5Public exploit code
CVE-2019-6273
download_file in GL.iNet GL-AR300M-Lite devices with firmware 2.27 allows remote attackers to download arbitrary files.
Public exploit code
Working exploit or proof of concept code has been published for this vulnerability. Treat unpatched systems as at risk.
- GL-AR300M-Lite 2.27 - (Authenticated) Command Injection / Arbitrary File Download / Directory Traversal2019-01-16 · webapps · hardware
Impact
download_file in GL.iNet GL-AR300M-Lite devices with firmware 2.27 allows remote attackers to download arbitrary files.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Gl-Inet | Gl-Ar300m-Lite Firmware | Version 2.27 |
Weakness classification
References
- NVD record
- CVE.org record
- http://packetstormsecurity.com/files/151207/GL-AR300M-Lite-2.2.7-Command-Injection-Directory-Traversal.html
- https://www.exploit-db.com/exploits/46179/
- http://packetstormsecurity.com/files/151207/GL-AR300M-Lite-2.2.7-Command-Injection-Directory-Traversal.html
- https://www.exploit-db.com/exploits/46179/