vendor:
GL.iNet
by:
Michele 'cyberaz0r' Di Bonaventura
8.1
CVSS
CRITICAL
Remote Code Execution
78
CWE
Product Name: GL.iNet
Affected Version From: 4.3.2007
Affected Version To: 4.3.2007
Patch Exists: YES
Related CWE: CVE-2023-46454
CPE: o:gl-inet:gl-inet_firmware:4.3.7
Platforms Tested: GL.iNet AR300M
2023
GL.iNet <= 4.3.7 Remote Code Execution via OpenVPN Client
The GL.iNet firmware version 4.3.7 is vulnerable to remote code execution via the OpenVPN client. An attacker can exploit this vulnerability to execute arbitrary commands on the target system. This vulnerability has been assigned CVE-2023-46454.
Mitigation:
Update GL.iNet firmware to version 4.3.8 or later to prevent exploitation of this vulnerability.
