Path Traversal Vulnerability in GL.iNet Devices
CVE-2023-31477

7.5HIGH

Key Information:

Vendor

Gl-inet

Status
Gl-s20 Firmware
Vendor
CVE Published:
11 May 2023

What is CVE-2023-31477?

A path traversal vulnerability has been identified in GL.iNet devices prior to version 3.216. This flaw allows unauthorized users to exploit the file sharing feature, enabling them to share arbitrary directories, including sensitive system directories like /tmp and /etc. The absence of server-side restrictions to confine sharing solely to the designated USB path poses significant security risks, potentially exposing critical system files and configurations. Addressing this issue is essential to maintain the integrity of GL.iNet devices and safeguard against unauthorized access.

References

https://www.gl-inet.com
https://github.com/gl-inet/CVE-issues/blob/main/3.215/Pat...

CVSS V3.1

Score:
7.5
Severity:
HIGH
Confidentiality:
High
Integrity:
None
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.