What is CVE-2023-31476?

CVE-2023-31476 is a high-severity vulnerability in Gl-Inet Gl-Mv1000, classified under Command Injection. CVSS score: 7.5/10. Published 2023-05-09.

How severe is CVE-2023-31476?

High severity. CVSS v3 base score is 7.5 out of 10.

RCE in Gl-Inet Gl-Mv1000

CVE-2023-31476

An issue was discovered on GL.iNet devices running firmware before 3.216. There is an arbitrary file write in which an empty file can be created almost anywhere on the filesystem, as long as the filename and path is no more than 6 characters (the working directory is /www).

Vulnerability class: Command Injection (OS Command Injection)

EPSS: 0.008 (53.0th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 7.5 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N.

Affected products

Gl-inet Gl-mv1000
Gl-inet Gl-mv1000_firmware
Gl-inet Gl-mv1000w
Gl-inet Gl-mv1000w_firmware
N/a — versions n/a

Weakness classification (CWE)

CWE-77 — Command Injection

References

cve@mitre.org (Product)
cve@mitre.org (Exploit, Third Party Advisory)

Frequently asked questions

What is CVE-2023-31476?: CVE-2023-31476 is a high-severity vulnerability in Gl-Inet Gl-Mv1000, classified under Command Injection. CVSS score: 7.5/10. Published 2023-05-09.
How severe is CVE-2023-31476?: High severity. CVSS v3 base score is 7.5 out of 10.