In GL.iNET GL-AR300M routers with firmware v4.3.7, it is possible to inject arbitrary shell commands through a crafted package name in the package information functionality.
An attacker sends a network request to the package management function on the device, providing a crafted package name containing malicious shell commands. The input is not properly validated or sanitized before being passed to the operating system command interpreter. As a result, commands supplied by the attacker are executed directly in the context of the router's operating system.
An attacker can execute arbitrary system commands on the router without authentication, which may lead to complete device takeover, theft of configuration data, modification of network settings, or use of the router as an entry point to the network infrastructure.
Patches available from the manufacturer should be applied according to the references. It is also recommended to restrict access to the router's administrative interface to trusted IP addresses only and to monitor network traffic for unauthorized requests.
GL.iNET GL-AR300M routers running firmware version 4.3.7
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HGl Inet Gl Ar300m
HWGl-Inetwszystkie wersjeGl Inet Gl Ar300m Firmware
OSGl-Inet4.3.7
Related vulnerabilities
GL.iNet — Authentication Bypass w NGINX przez dopasowanie wzorców Lua
GL.iNet: privilege escalation przez interfejs add_user do uprawnień root
GL.iNET GL-AR300M: command injection przez upload pliku konfiguracji OpenVPN
An issue was discovered on GL.iNet devices before 3.216. The function guci2_get() found in libglutil.so has a ...
An issue was discovered on GL.iNet devices before 3.216. Through the software installation feature, it is poss...