CVE-2023-31476
Last modified
CVE-2023-31476 is a high-severity vulnerability rated 7.5/10 on the CVSS scale. An issue was discovered on GL.iNet devices running firmware before 3.216. There is an arbitrary file write in which an empty file can be created almost anywhere on the filesystem, as long as the filename and path is no more than 6 characters (the working directory is /www).. EPSS estimates a 0.80% chance of exploitation in the next 30 days.
Description
An issue was discovered on GL.iNet devices running firmware before 3.216. There is an arbitrary file write in which an empty file can be created almost anywhere on the filesystem, as long as the filename and path is no more than 6 characters (the working directory is /www).
Metrics
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Gl-Inet | Gl-Mv1000w Firmware | <= 3.215 |
| Gl-Inet | Gl-Mv1000 Firmware | <= 3.215 |
References
- https://github.com/gl-inet/CVE-issues/blob/main/3.215/GL-MV1000_Arbitrary_File_Creation.mdExploit, Third Party Advisory
- https://www.gl-inet.comProduct
- https://github.com/gl-inet/CVE-issues/blob/main/3.215/GL-MV1000_Arbitrary_File_Creation.mdExploit, Third Party Advisory
- https://www.gl-inet.comProduct
Timeline
- Published
- Last Modified
- Status
- Modified
Frequently Asked Questions
What is CVE-2023-31476?
How severe is CVE-2023-31476?
How do I fix CVE-2023-31476?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2023
- CVE-2023-31470SmartDNS through 41 before 56d0332 allows an out-of-bounds w…9.8
- CVE-2023-31471An issue was discovered on GL.iNet devices before 3.216. Thr…9.8
- CVE-2023-31472An issue was discovered on GL.iNet devices before 3.216. The…7.5
- CVE-2023-31473An issue was discovered on GL.iNet devices before 3.216. The…4.9
- CVE-2023-31474An issue was discovered on GL.iNet devices before 3.216. Thr…7.5
- CVE-2023-31475An issue was discovered on GL.iNet devices before 3.216. The…9.8
- CVE-2023-31477A path traversal issue was discovered on GL.iNet devices bef…7.5
- CVE-2023-31478An issue was discovered on GL.iNet devices before 3.216. An …7.5
- CVE-2023-3148A vulnerability was found in SourceCodester Online Discussio…8.8
- CVE-2023-31483tar/TarFileReader.cpp in Cauldron cbang before bastet-v8.1.1…7.5
- CVE-2023-31484CPAN.pm before 2.35 does not verify TLS certificates when do…8.1
- CVE-2023-31485GitLab::API::v4 through 0.26 does not verify TLS certificate…5.9
Are you affected by CVE-2023-31476?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST