CVSS: 5.9EPSS: 0%CPEs: 2EXPL: 1CVE-2023-33620
https://notcve.org/view.php?id=CVE-2023-33620
GL.iNET GL-AR750S-Ext firmware v3.215 uses an insecure protocol in its communications which allows attackers to eavesdrop via a man-in-the-middle attack. • http://gl-ar750s-ext.com http://glinet.com https://justinapplegate.me/2023/glinet-CVE-2023-33620 • CWE-522: Insufficiently Protected Credentials •
CVSS: 5.9EPSS: 0%CPEs: 2EXPL: 1CVE-2023-33621
https://notcve.org/view.php?id=CVE-2023-33621
GL.iNET GL-AR750S-Ext firmware v3.215 inserts the admin authentication token into a GET request when the OpenVPN Server config file is downloaded. The token is then left in the browser history or access logs, potentially allowing attackers to bypass authentication via session replay. • http://gl-ar750s-ext.com http://glinet.com https://justinapplegate.me/2023/glinet-CVE-2023-33621 • CWE-294: Authentication Bypass by Capture-replay •
CVSS: 9.8EPSS: 0%CPEs: 64EXPL: 1CVE-2023-31475
https://notcve.org/view.php?id=CVE-2023-31475
An issue was discovered on GL.iNet devices before 3.216. The function guci2_get() found in libglutil.so has a buffer overflow when an item is requested from a UCI context, and the value is pasted into a char pointer to a buffer without checking the size of the buffer. • https://github.com/gl-inet/CVE-issues/blob/main/3.215/Buffer_Overflow.md https://justinapplegate.me/2023/glinet-CVE-2023-31475 https://www.gl-inet.com • CWE-120: Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') •
CVSS: 7.5EPSS: 0%CPEs: 64EXPL: 1CVE-2023-31477
https://notcve.org/view.php?id=CVE-2023-31477
A path traversal issue was discovered on GL.iNet devices before 3.216. Through the file sharing feature, it is possible to share an arbitrary directory, such as /tmp or /etc, because there is no server-side restriction to limit sharing to the USB path. • https://github.com/gl-inet/CVE-issues/blob/main/3.215/Path_Traversal.md https://www.gl-inet.com • CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') •
CVSS: 4.9EPSS: 0%CPEs: 64EXPL: 1CVE-2023-31473
https://notcve.org/view.php?id=CVE-2023-31473
An issue was discovered on GL.iNet devices before 3.216. There is an arbitrary file write in which an empty file can be created anywhere on the filesystem. This is caused by a command injection vulnerability with a filter applied. Through the software installation feature, it is possible to inject arbitrary parameters in a request to cause opkg to read an arbitrary file name while using root privileges. The -f option can be used with a configuration file. • https://github.com/gl-inet/CVE-issues/blob/main/3.215/Arbitrary_File_Read.md https://www.gl-inet.com • CWE-77: Improper Neutralization of Special Elements used in a Command ('Command Injection') •