What is CVE-2023-31472?

CVE-2023-31472 is a high-severity vulnerability in Gl-Inet Gl-A1300, classified under Allocation of Resources Without Limits or Throttling. CVSS score: 7.5/10. Published 2023-05-09.

How severe is CVE-2023-31472?

High severity. CVSS v3 base score is 7.5 out of 10.

Resource exhaustion in Gl-Inet Gl-A1300

CVE-2023-31472

An issue was discovered on GL.iNet devices before 3.216. There is an arbitrary file write in which an empty file can be created anywhere on the filesystem. This is caused by a command injection vulnerability with a filter applied.

Published 2023-05-09 · last modified 2026-06-17.

CVSS v3 metric

CVSS v3 base score 7.5 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N.

EPSS exploit prediction

EPSS: 0.199 (97.3th percentile), scored 2026-09-30.

Moderate probability of exploitation in the next 30 days — watch for active exploitation reports. 97th percentile — 97.3% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.

EPSS over last 30 days · oldest: 0.199 · newest: 0.199 · change: 0.000

Affected products

Weakness classification (CWE)

CWE-770 — Allocation of Resources Without Limits or Throttling

References

www.gl-inet.com (Vendor Advisory)
github.com/gl-inet/CVE-issues/blob/main/3.215/Arbitrary_File_Creation.md (Exploit, Vendor Advisory)

Frequently asked questions

What is CVE-2023-31472?: CVE-2023-31472 is a high-severity vulnerability in Gl-Inet Gl-A1300, classified under Allocation of Resources Without Limits or Throttling. CVSS score: 7.5/10. Published 2023-05-09.
How severe is CVE-2023-31472?: High severity. CVSS v3 base score is 7.5 out of 10.