CVE-2023-47464
Published: 30 November 2023
Summary
CVE-2023-47464 is a high-severity Path Traversal (CWE-22) vulnerability in Gl-Inet Gl-Ax1800 Firmware. Its CVSS base score is 8.8 (High).
Operationally, ranked in the top 1.3% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
Deeper analysis
CVE-2023-47464 is an insecure permissions vulnerability, tracked under CWE-22, that affects the upload API function in GL.iNet AX1800 firmware versions 4.0.0 through 4.4.x. The flaw permits path traversal or unauthorized file placement during upload operations, enabling remote code execution on the device.
An attacker with valid low-privileged credentials can reach the affected API over the network and supply crafted upload requests. Successful exploitation grants the ability to write arbitrary files, resulting in full compromise of confidentiality, integrity, and availability on the router.
Public disclosure is documented in the GL.iNet CVE repository, which details the arbitrary file creation vector through the upload endpoint and identifies the fixed release as version 4.5.0. The associated EPSS score has remained at 0.7010 with no indicated upward trajectory after publication.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2023-51576
Vulnerability details
Insecure Permissions vulnerability in GL.iNet AX1800 version 4.0.0 before 4.5.0 allows a remote attacker to execute arbitrary code via the upload API function.
- CWE(s)
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
Likely Mitigating Controls AI
Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.
Validates pathnames and filenames to prevent traversal outside intended directories.