CVE-2023-46456
Published: 12 December 2023
Summary
CVE-2023-46456 is a critical-severity Injection (CWE-74) vulnerability in Gl-Inet Gl-Ar300M Firmware. Its CVSS base score is 9.8 (Critical).
Operationally, ranked in the top 5.5% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
Deeper analysis
CVE-2023-46456 is a command injection vulnerability (CWE-74) affecting GL.iNET GL-AR300M routers running firmware version 3.216. The flaw resides in the OpenVPN client file upload functionality and permits injection of arbitrary shell commands. It carries a CVSS 3.1 base score of 9.8, reflecting network attack vector, low attack complexity, and no required privileges or user interaction.
An unauthenticated remote attacker can supply a malicious OpenVPN configuration file to the affected device and thereby execute arbitrary commands on the underlying system. Successful exploitation grants complete control over the router, enabling full read/write access to device resources and disruption of availability.
Public references consist of a technical disclosure at cyberaz0r.info and the vendor site at gl-inet.com; administrators should review those sources for any available firmware updates or configuration guidance. The associated EPSS score has remained flat at 0.1395 with no material increase since publication.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2023-50672
Vulnerability details
In GL.iNET GL-AR300M routers with firmware 3.216 it is possible to inject arbitrary shell commands through the OpenVPN client file upload functionality.
- CWE(s)
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
Likely Mitigating Controls AI
Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.
Developer assessments and testing (including injection-focused techniques) identify improper neutralization of special elements, and the verifiable flaw remediation corrects them pre-deployment.
Identifies indicators of injection attacks (command, SQL, LDAP, etc.) via anomaly and attack monitoring.