CVE Feed

    Dashboard / CVE / CVE-2023-46454

    CVE-2023-46454

    In GL.iNET GL-AR300M routers with firmware v4.3.7, it is possible to inject arbitrary shell commands through a crafted package name in the package information functionality.

    Published:Dec 12, 2023
    Last Modified:Nov 21, 2024
    EPS:Dec 12, 2023
    EPSS Score:0.15671
    CVSS Score:9.8

    Affected Products

    Vendor
    Gl-inet
    Product
    Gl-ar300m
    Vendor
    Gl-inet
    Product
    Gl-ar300m Firmware

    Exploits

    https://github.com/cyberaz0r/GL.iNet-Multiple-Vulnerabilities

    Related CVEs

    CVE-2024-39227 (CVSS 9.8) — GL-iNet products AR750/AR750S/AR300M/AR300M16/MT300N-V2/B1300/MT1300/SFT1200/X750 v4.3.11, MT3000/MT2500/AXT18…
    CVE-2023-50920 (CVSS 5.5) — An issue was discovered on GL.iNet devices before version 4.5.0. They assign the same session ID after each us…
    CVE-2023-50919 (CVSS 9.8) — An issue was discovered on GL.iNet devices before version 4.5.0. There is an NGINX authentication bypass via L…
    CVE-2023-50921 (CVSS 9.8) — An issue was discovered on GL.iNet devices through 4.5.0. Attackers can invoke the add_user interface in the s…
    CVE-2023-50922 (CVSS 7.2) — An issue was discovered on GL.iNet devices through 4.5.0. Attackers who are able to steal the AdminToken cooki…
    CVE-2023-50445 (CVSS 7.8) — Shell Injection vulnerability GL.iNet A1300 v4.4.6, AX1800 v4.4.6, AXT1800 v4.4.6, MT3000 v4.4.6, MT2500 v4.4.…
    CVE-2023-46455 (CVSS 7.5) — In GL.iNET GL-AR300M routers with firmware v4.3.7 it is possible to write arbitrary files through a path trave…
    CVE-2023-46456 (CVSS 9.8) — In GL.iNET GL-AR300M routers with firmware 3.216 it is possible to inject arbitrary shell commands through the…
    CVE-2023-31473 (CVSS 4.9) — An issue was discovered on GL.iNet devices before 3.216. There is an arbitrary file write in which an empty fi…
    CVE-2023-31475 (CVSS 9.8) — An issue was discovered on GL.iNet devices before 3.216. The function guci2_get() found in libglutil.so has a …

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High