ByteOS Network

Vulnerability Details :

CVE-2023-31474

Assigner-mitre

Assigner Org ID-8254265b-2729-46b6-b9e3-3dfca2d5bfca

Published At-09 May, 2023 | 00:00

Updated At-29 Jan, 2025 | 20:26

An issue was discovered on GL.iNet devices before 3.216. Through the software installation feature, it is possible to inject arbitrary parameters in a request to cause opkg to obtain a list of files in a specific directory, by using the regex feature in a package name.

EPSS History

Score

Latest Score

N/A

Percentile

Latest Percentile

N/A

▼Common Vulnerabilities and Exposures (CVE)

cve.org

Assigner:mitre

Assigner Org ID:8254265b-2729-46b6-b9e3-3dfca2d5bfca

Published At:09 May, 2023 | 00:00

Updated At:29 Jan, 2025 | 20:26

▼CVE Numbering Authority (CNA)

Affected Products

Vendor

n/a

Product

n/a

Versions

Affected

Problem Types

Type	CWE ID	Description
text	N/A	n/a

Type: text

CWE ID: N/A

Description: n/a

References

Hyperlink	Resource
https://www.gl-inet.com	N/A
https://github.com/gl-inet/CVE-issues/blob/main/3.215/Directory_Listing.md	N/A

Hyperlink: https://www.gl-inet.com

Resource: N/A

Hyperlink: https://github.com/gl-inet/CVE-issues/blob/main/3.215/Directory_Listing.md

Resource: N/A

▼Authorized Data Publishers (ADP)

1. CVE Program Container

References

Hyperlink	Resource
https://www.gl-inet.com	x_transferred
https://github.com/gl-inet/CVE-issues/blob/main/3.215/Directory_Listing.md	x_transferred

Hyperlink: https://www.gl-inet.com

Resource:

x_transferred

Hyperlink: https://github.com/gl-inet/CVE-issues/blob/main/3.215/Directory_Listing.md

Resource:

x_transferred

2. CISA ADP Vulnrichment

Problem Types

Type	CWE ID	Description
CWE	CWE-noinfo	CWE-noinfo Not enough information

Type: CWE

CWE ID: CWE-noinfo

Description: CWE-noinfo Not enough information

Metrics

Version	Base score	Base severity	Vector
3.1	7.5	HIGH	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Version: 3.1

Base score: 7.5

Base severity: HIGH

Vector:

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Metrics Other Info

▼National Vulnerability Database (NVD)

nvd.nist.gov

Source:cve@mitre.org

Published At:09 May, 2023 | 18:15

Updated At:29 Jan, 2025 | 21:15

Date Added	Due Date	Vulnerability Name	Required Action
	N/A

Metrics

Type	Version	Base score	Base severity	Vector
Primary	3.1	7.5	HIGH	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Secondary	3.1	7.5	HIGH	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Type: Primary

Version: 3.1

Base score: 7.5

Base severity: HIGH

Vector:

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Type: Secondary

Version: 3.1

Base score: 7.5

Base severity: HIGH

Vector:

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

CPE Matches

gl-inet>>gl-s20_firmware>>Versions before 3.216(exclusive)

cpe:2.3:o:gl-inet:gl-s20_firmware:*:*:*:*:*:*:*:*

gl-inet>>gl-s20>>-

cpe:2.3:h:gl-inet:gl-s20:-:*:*:*:*:*:*:*

gl-inet>>gl-x3000_firmware>>Versions before 3.216(exclusive)

cpe:2.3:o:gl-inet:gl-x3000_firmware:*:*:*:*:*:*:*:*

gl-inet>>gl-x3000>>-

cpe:2.3:h:gl-inet:gl-x3000:-:*:*:*:*:*:*:*

gl-inet>>gl-mt3000_firmware>>Versions before 3.216(exclusive)

cpe:2.3:o:gl-inet:gl-mt3000_firmware:*:*:*:*:*:*:*:*

gl-inet>>gl-mt3000>>-

cpe:2.3:h:gl-inet:gl-mt3000:-:*:*:*:*:*:*:*

gl-inet>>gl-mt2500_firmware>>Versions before 3.216(exclusive)

cpe:2.3:o:gl-inet:gl-mt2500_firmware:*:*:*:*:*:*:*:*

gl-inet>>gl-mt2500>>-

cpe:2.3:h:gl-inet:gl-mt2500:-:*:*:*:*:*:*:*

gl-inet>>gl-mt2500a_firmware>>Versions before 3.216(exclusive)

cpe:2.3:o:gl-inet:gl-mt2500a_firmware:*:*:*:*:*:*:*:*

gl-inet>>gl-mt2500a>>-

cpe:2.3:h:gl-inet:gl-mt2500a:-:*:*:*:*:*:*:*

gl-inet>>gl-axt1800_firmware>>Versions before 3.216(exclusive)

cpe:2.3:o:gl-inet:gl-axt1800_firmware:*:*:*:*:*:*:*:*

gl-inet>>gl-axt1800>>-

cpe:2.3:h:gl-inet:gl-axt1800:-:*:*:*:*:*:*:*

gl-inet>>gl-a1300_firmware>>Versions before 3.216(exclusive)

cpe:2.3:o:gl-inet:gl-a1300_firmware:*:*:*:*:*:*:*:*

gl-inet>>gl-a1300>>-

cpe:2.3:h:gl-inet:gl-a1300:-:*:*:*:*:*:*:*

gl-inet>>gl-ax1800_firmware>>Versions before 3.216(exclusive)

cpe:2.3:o:gl-inet:gl-ax1800_firmware:*:*:*:*:*:*:*:*

gl-inet>>gl-ax1800>>-

cpe:2.3:h:gl-inet:gl-ax1800:-:*:*:*:*:*:*:*

gl-inet>>gl-sft1200_firmware>>Versions before 3.216(exclusive)

cpe:2.3:o:gl-inet:gl-sft1200_firmware:*:*:*:*:*:*:*:*

gl-inet>>gl-sft1200>>-

cpe:2.3:h:gl-inet:gl-sft1200:-:*:*:*:*:*:*:*

gl-inet>>gl-mt1300_firmware>>Versions before 3.216(exclusive)

cpe:2.3:o:gl-inet:gl-mt1300_firmware:*:*:*:*:*:*:*:*

gl-inet>>gl-mt1300>>-

cpe:2.3:h:gl-inet:gl-mt1300:-:*:*:*:*:*:*:*

gl-inet>>gl-e750_firmware>>Versions before 3.216(exclusive)

cpe:2.3:o:gl-inet:gl-e750_firmware:*:*:*:*:*:*:*:*

gl-inet>>gl-e750>>-

cpe:2.3:h:gl-inet:gl-e750:-:*:*:*:*:*:*:*

gl-inet>>gl-mv1000_firmware>>Versions before 3.216(exclusive)

cpe:2.3:o:gl-inet:gl-mv1000_firmware:*:*:*:*:*:*:*:*

gl-inet>>gl-mv1000>>-

cpe:2.3:h:gl-inet:gl-mv1000:-:*:*:*:*:*:*:*

gl-inet>>gl-mv1000w_firmware>>Versions before 3.216(exclusive)

cpe:2.3:o:gl-inet:gl-mv1000w_firmware:*:*:*:*:*:*:*:*

gl-inet>>gl-mv1000w>>-

cpe:2.3:h:gl-inet:gl-mv1000w:-:*:*:*:*:*:*:*

gl-inet>>gl-s10_firmware>>Versions before 3.216(exclusive)

cpe:2.3:o:gl-inet:gl-s10_firmware:*:*:*:*:*:*:*:*

gl-inet>>gl-s10>>-

cpe:2.3:h:gl-inet:gl-s10:-:*:*:*:*:*:*:*

gl-inet>>gl-s200_firmware>>Versions before 3.216(exclusive)

cpe:2.3:o:gl-inet:gl-s200_firmware:*:*:*:*:*:*:*:*

gl-inet>>gl-s200>>-

cpe:2.3:h:gl-inet:gl-s200:-:*:*:*:*:*:*:*

gl-inet>>gl-s1300_firmware>>Versions before 3.216(exclusive)

cpe:2.3:o:gl-inet:gl-s1300_firmware:*:*:*:*:*:*:*:*

gl-inet>>gl-s1300>>-

cpe:2.3:h:gl-inet:gl-s1300:-:*:*:*:*:*:*:*

gl-inet>>gl-sf1200_firmware>>Versions before 3.216(exclusive)

cpe:2.3:o:gl-inet:gl-sf1200_firmware:*:*:*:*:*:*:*:*

gl-inet>>gl-sf1200>>-

cpe:2.3:h:gl-inet:gl-sf1200:-:*:*:*:*:*:*:*

gl-inet>>gl-b1300_firmware>>Versions before 3.216(exclusive)

cpe:2.3:o:gl-inet:gl-b1300_firmware:*:*:*:*:*:*:*:*

gl-inet>>gl-b1300>>-

cpe:2.3:h:gl-inet:gl-b1300:-:*:*:*:*:*:*:*

gl-inet>>gl-b2200_firmware>>Versions before 3.216(exclusive)

cpe:2.3:o:gl-inet:gl-b2200_firmware:*:*:*:*:*:*:*:*

gl-inet>>gl-b2200>>-

cpe:2.3:h:gl-inet:gl-b2200:-:*:*:*:*:*:*:*

gl-inet>>gl-ap1300_firmware>>Versions before 3.216(exclusive)

cpe:2.3:o:gl-inet:gl-ap1300_firmware:*:*:*:*:*:*:*:*

gl-inet>>gl-ap1300>>-

cpe:2.3:h:gl-inet:gl-ap1300:-:*:*:*:*:*:*:*

gl-inet>>gl-ap1300lte_firmware>>Versions before 3.216(exclusive)

cpe:2.3:o:gl-inet:gl-ap1300lte_firmware:*:*:*:*:*:*:*:*

gl-inet>>gl-ap1300lte>>-

cpe:2.3:h:gl-inet:gl-ap1300lte:-:*:*:*:*:*:*:*

gl-inet>>gl-x1200_firmware>>Versions before 3.216(exclusive)

cpe:2.3:o:gl-inet:gl-x1200_firmware:*:*:*:*:*:*:*:*

gl-inet>>gl-x1200>>-

cpe:2.3:h:gl-inet:gl-x1200:-:*:*:*:*:*:*:*

gl-inet>>gl-x750_firmware>>Versions before 3.216(exclusive)

cpe:2.3:o:gl-inet:gl-x750_firmware:*:*:*:*:*:*:*:*

gl-inet>>gl-x750>>-

cpe:2.3:h:gl-inet:gl-x750:-:*:*:*:*:*:*:*

gl-inet>>gl-x300b_firmware>>Versions before 3.216(exclusive)

cpe:2.3:o:gl-inet:gl-x300b_firmware:*:*:*:*:*:*:*:*

gl-inet>>gl-x300b>>-

cpe:2.3:h:gl-inet:gl-x300b:-:*:*:*:*:*:*:*

gl-inet>>gl-xe300_firmware>>Versions before 3.216(exclusive)

cpe:2.3:o:gl-inet:gl-xe300_firmware:*:*:*:*:*:*:*:*

gl-inet>>gl-xe300>>-

cpe:2.3:h:gl-inet:gl-xe300:-:*:*:*:*:*:*:*

Weaknesses

CWE ID	Type	Source
NVD-CWE-noinfo	Primary	nvd@nist.gov

CWE ID: NVD-CWE-noinfo

Type: Primary

Source: nvd@nist.gov

References

Hyperlink	Source	Resource
https://github.com/gl-inet/CVE-issues/blob/main/3.215/Directory_Listing.md	cve@mitre.org	Exploit
https://www.gl-inet.com	cve@mitre.org	Vendor Advisory
https://github.com/gl-inet/CVE-issues/blob/main/3.215/Directory_Listing.md	af854a3a-2127-422b-91ae-364da2661108	Exploit
https://www.gl-inet.com	af854a3a-2127-422b-91ae-364da2661108	Vendor Advisory

Hyperlink: https://github.com/gl-inet/CVE-issues/blob/main/3.215/Directory_Listing.md

Source: cve@mitre.org

Resource:

Exploit

Hyperlink: https://www.gl-inet.com

Source: cve@mitre.org

Resource:

Vendor Advisory

Hyperlink: https://github.com/gl-inet/CVE-issues/blob/main/3.215/Directory_Listing.md

Source: af854a3a-2127-422b-91ae-364da2661108

Resource:

Exploit

Hyperlink: https://www.gl-inet.com

Source: af854a3a-2127-422b-91ae-364da2661108

Resource:

Vendor Advisory

Similar CVEs

3Records found

CVE-2024-27356

Matching Score-8

Assigner-MITRE Corporation

View Details

Matching Score-8

Assigner-MITRE Corporation

CVSS Score-7.5||HIGH

EPSS-23.04% / 95.70%

7 Day CHG+4.71%

Published-27 Feb, 2024 | 00:00

Updated-24 Mar, 2025 | 16:15

An issue was discovered on certain GL-iNet devices. Attackers can download files such as logs via commands, potentially obtaining critical user information. This affects MT6000 4.5.5, XE3000 4.4.4, X3000 4.4.5, MT3000 4.5.0, MT2500 4.5.0, AXT1800 4.5.0, AX1800 4.5.0, A1300 4.5.0, S200 4.1.4-0300, X750 4.3.7, SFT1200 4.3.7, XE300 4.3.7, MT1300 4.3.10, AR750 4.3.10, AR750S 4.3.10, AR300M 4.3.10, AR300M16 4.3.10, B1300 4.3.10, MT300N-v2 4.3.10, X300B 3.217, S1300 3.216, SF1200 3.216, MV1000 3.216, N300 3.216, B2200 3.216, and X1200 3.203.

Vendor-n/a gl-i gl-inet gl.inet

Product-n/a n300 MT6000 mv1000 xe3000 x3000 sf1200 mt300nv2 mt1300 x300b s200 x750 0300 b1300 x1200 ar750 sft1200 ax1800 b2200 mt3000 s1300 ar3000m16 a1300 mt2500 ar750s xe300 ar3000m axt1800

CWE ID-CWE-200

Exposure of Sensitive Information to an Unauthorized Actor

CVE-2023-31478

Matching Score-8

Assigner-MITRE Corporation

View Details

Matching Score-8

Assigner-MITRE Corporation

CVSS Score-7.5||HIGH

EPSS-82.64% / 99.19%

7 Day CHG+0.48%

Published-09 May, 2023 | 00:00

Updated-29 Jan, 2025 | 21:15

An issue was discovered on GL.iNet devices before 3.216. An API endpoint reveals information about the Wi-Fi configuration, including the SSID and key.

Vendor-gl-inet n/a

Product-gl-axt1800 gl-s200_firmware gl-xe300 gl-mifi_firmware gl-x750 gl-b1300_firmware gl-ap1300_firmware gl-ar300m gl-x3000 gl-usb150 gl-mt3000 gl-s200 gl-xe300_firmware gl-ar750 gl-sf1200 gl-s10 gl-b2200 gl-x300b gl-mt300n-v2_firmware gl-axt1800_firmware gl-ax1800_firmware gl-mt2500a_firmware gl-s20_firmware microuter-n300_firmware gl-ap1300lte_firmware gl-ap1300lte gl-mv1000w microuter-n300 gl-x1200_firmware gl-mt300n-v2 gl-ax1800 gl-e750_firmware gl-b1300 gl-a1300_firmware gl-x300b_firmware gl-mv1000 gl-mt1300 gl-sf1200_firmware gl-ar750s gl-a1300 gl-sft1200_firmware gl-mv1000_firmware gl-ar750_firmware gl-e750 gl-s1300 gl-ar750s_firmware gl-mifi gl-mt2500_firmware gl-ar300m_firmware gl-x1200 gl-mt3000_firmware gl-mt1300_firmware gl-mv1000w_firmware gl-b2200_firmware gl-x750_firmware gl-s20 gl-usb150_firmware gl-s10_firmware gl-mt2500 gl-sft1200 gl-mt2500a gl-s1300_firmware gl-x3000_firmware gl-ap1300 n/a

CVE-2023-31477

Matching Score-8

Assigner-MITRE Corporation

View Details

Matching Score-8

Assigner-MITRE Corporation

CVSS Score-7.5||HIGH

EPSS-0.24% / 46.35%

7 Day CHG~0.00%

Published-11 May, 2023 | 00:00

Updated-27 Jan, 2025 | 18:15

A path traversal issue was discovered on GL.iNet devices before 3.216. Through the file sharing feature, it is possible to share an arbitrary directory, such as /tmp or /etc, because there is no server-side restriction to limit sharing to the USB path.

Vendor-gl-inet n/a

Product-gl-mt3000 gl-s1300 gl-x1200 gl-mt1300_firmware gl-mv1000_firmware gl-ar750s gl-s200 gl-s10 gl-s200_firmware gl-axt1800 gl-mt2500_firmware gl-e750 gl-x750_firmware gl-s10_firmware gl-sft1200_firmware gl-mv1000w gl-mt2500 gl-ap1300lte_firmware gl-usb150 gl-mv1000w_firmware gl-mt300n-v2_firmware gl-mt3000_firmware gl-a1300 gl-sft1200 gl-ar750s_firmware gl-ar750_firmware gl-s20_firmware gl-x1200_firmware gl-mt2500a gl-ap1300lte gl-x300b_firmware gl-ap1300 gl-sf1200_firmware gl-ar300m gl-usb150_firmware gl-b1300_firmware gl-e750_firmware gl-mt2500a_firmware gl-sf1200 gl-mt1300 gl-x3000 gl-xe300_firmware gl-s20 gl-ax1800_firmware gl-ar750 gl-mifi_firmware gl-s1300_firmware gl-x750 gl-x3000_firmware gl-xe300 gl-b2200 microuter-n300_firmware gl-mv1000 gl-a1300_firmware gl-mifi microuter-n300 gl-b2200_firmware gl-axt1800_firmware gl-mt300n-v2 gl-ar300m_firmware gl-ap1300_firmware gl-x300b gl-ax1800 gl-b1300 n/a

CWE ID-CWE-22

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

CVE-2023-31474

Credits

Vendors

Products

Metrics (CVSS)

Weaknesses

Attack Patterns

Solution/Workaround

References

EPSS History

Score

Latest Score

N/A

Percentile

Latest Percentile

N/A

Stakeholder-Specific Vulnerability Categorization (SSVC)

Affected Products

Affected

Problem Types

Metrics

Metrics Other Info

Impacts

Solutions

Configurations

Workarounds

Exploits

Credits

Timeline

Replaced By

Rejected Reason

References

Affected Products

Metrics

Metrics Other Info

Impacts

Solutions

Configurations

Workarounds

Exploits

Credits

Timeline

Replaced By

Rejected Reason

References

Affected Products

Problem Types

Metrics

Metrics Other Info

Impacts

Solutions

Configurations

Workarounds

Exploits

Credits

Timeline

Replaced By

Rejected Reason

References

CISA Catalog

Metrics

CPE Matches

Weaknesses

Evaluator Description

Evaluator Impact

Evaluator Solution

Vendor Statements

References

Change History

Similar CVEs