CVE-2023-31476
Last modified
CVE-2023-31476 is a high-severity vulnerability rated 7.5/10 on the CVSS scale. An issue was discovered on GL.iNet devices running firmware before 3.216. There is an arbitrary file write in which an empty file can be created almost anywhere on the filesystem, as long as the filename and path is no more than 6 characters (the working directory is /www).. EPSS estimates a 0.80% chance of exploitation in the next 30 days.
Description
An issue was discovered on GL.iNet devices running firmware before 3.216. There is an arbitrary file write in which an empty file can be created almost anywhere on the filesystem, as long as the filename and path is no more than 6 characters (the working directory is /www).
Metrics
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Gl-Inet | Gl-Mv1000w Firmware | <= 3.215 |
| Gl-Inet | Gl-Mv1000 Firmware | <= 3.215 |
References
- https://github.com/gl-inet/CVE-issues/blob/main/3.215/GL-MV1000_Arbitrary_File_Creation.mdExploit, Third Party Advisory
- https://www.gl-inet.comProduct
- https://github.com/gl-inet/CVE-issues/blob/main/3.215/GL-MV1000_Arbitrary_File_Creation.mdExploit, Third Party Advisory
- https://www.gl-inet.comProduct
Timeline
- Published
- Last Modified
- Status
- Modified
Frequently Asked Questions
What is CVE-2023-31476?
How severe is CVE-2023-31476?
How do I fix CVE-2023-31476?
Are you affected by CVE-2023-31476?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST