vendor:
GL.iNet
by:
Michele 'cyberaz0r' Di Bonaventura
8.1
CVSS
CRITICAL
Remote Code Execution
CWE
Product Name: GL.iNet
Affected Version From: 3.216
Affected Version To: 3.216
Patch Exists: YES
Related CWE: CVE-2023-46456
CPE: o:gl-inet:gl-inet_firmware:3.216
Platforms Tested: GL.iNet AR300M
2023
GL.iNet <= 3.216 Remote Code Execution via OpenVPN Client
GL.iNet version 3.216 is vulnerable to remote code execution via the OpenVPN client. An attacker can exploit this vulnerability by adding a malicious configuration file or client, allowing them to execute arbitrary code on the target system. This vulnerability is identified as CVE-2023-46456.
Mitigation:
Update GL.iNet firmware to version 3.217 or later to mitigate this remote code execution vulnerability.
