critical9.8
CVE-2023-31471
An issue was discovered on GL.iNet devices before 3.216.
Impact
An issue was discovered on GL.iNet devices before 3.216. Through the software installation feature, it is possible to install arbitrary software, such as a reverse shell, because the restrictions on the available package list are limited to client-side verification. It is possible to install software from the filesystem, the package list, or a URL.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Gl-Inet | Gl-S20 Firmware | before 3.216 |
| Gl-Inet | Gl-X3000 Firmware | before 3.216 |
| Gl-Inet | Gl-Mt3000 Firmware | before 3.216 |
| Gl-Inet | Gl-Mt2500 Firmware | before 3.216 |
| Gl-Inet | Gl-Mt2500a Firmware | before 3.216 |
| Gl-Inet | Gl-Axt1800 Firmware | before 3.216 |
| Gl-Inet | Gl-A1300 Firmware | before 3.216 |
| Gl-Inet | Gl-Ax1800 Firmware | before 3.216 |
| Gl-Inet | Gl-Sft1200 Firmware | before 3.216 |
| Gl-Inet | Gl-Mt1300 Firmware | before 3.216 |
| Gl-Inet | Gl-E750 Firmware | before 3.216 |
| Gl-Inet | Gl-Mv1000 Firmware | before 3.216 |