CVE-2023-31473

An issue was discovered on GL.iNet devices before 3.216. There is an arbitrary file write in which an empty file can be created anywhere on the filesystem. This is caused by a command injection vulnerability with a filter applied. Through the software installation feature, it is possible to inject arbitrary parameters in a request to cause opkg to read an arbitrary file name while using root privileges. The -f option can be used with a configuration file.

• CWE-77
• CWE-77

• https://github.com/gl-inet/CVE-issues/blob/main/3.215/Arbitrary_File_Read.mdExploit, Third Party Advisory
• https://www.gl-inet.comVendor Advisory
• https://github.com/gl-inet/CVE-issues/blob/main/3.215/Arbitrary_File_Read.mdExploit, Third Party Advisory
• https://www.gl-inet.comVendor Advisory

Published

May 11, 2023

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2023-31468An issue was discovered in Inosoft VisiWin 7 through 2022-2.…7.8
• CVE-2023-31469 A REST interface in Apache StreamPipes (versions 0.69.0 to …8.8
• CVE-2023-3147A vulnerability has been found in SourceCodester Online Disc…8.8
• CVE-2023-31470SmartDNS through 41 before 56d0332 allows an out-of-bounds w…9.8
• CVE-2023-31471An issue was discovered on GL.iNet devices before 3.216. Thr…9.8
• CVE-2023-31472An issue was discovered on GL.iNet devices before 3.216. The…7.5
• CVE-2023-31474An issue was discovered on GL.iNet devices before 3.216. Thr…7.5
• CVE-2023-31475An issue was discovered on GL.iNet devices before 3.216. The…9.8
• CVE-2023-31476An issue was discovered on GL.iNet devices running firmware …7.5
• CVE-2023-31477A path traversal issue was discovered on GL.iNet devices bef…7.5
• CVE-2023-31478An issue was discovered on GL.iNet devices before 3.216. An …7.5
• CVE-2023-3148A vulnerability was found in SourceCodester Online Discussio…8.8