CVE-2023-31478
published 2023-05-09CVE-2023-31478: An issue was discovered on GL.iNet devices before 3.216. An API endpoint reveals information about the Wi-Fi configuration, including the SSID and key.
PriorityP181high7.5CVSS 3.1
AVNACLPRNUINSUCHINAN
ITWEXPLOITVulnCheck KEV
Exploited in the wild
EPSS
29.70%
98.0th percentile
An issue was discovered on GL.iNet devices before 3.216. An API endpoint reveals information about the Wi-Fi configuration, including the SSID and key.
Affected
32 ranges· showing 25
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| gl-inet | gl-a1300_firmware | < 3.216 | 3.216 |
| gl-inet | gl-ap1300_firmware | < 3.216 | 3.216 |
| gl-inet | gl-ap1300lte_firmware | < 3.216 | 3.216 |
| gl-inet | gl-ar300m_firmware | < 3.216 | 3.216 |
| gl-inet | gl-ar750_firmware | < 3.216 | 3.216 |
| gl-inet | gl-ar750s_firmware | < 3.216 | 3.216 |
| gl-inet | gl-ax1800_firmware | < 3.216 | 3.216 |
| gl-inet | gl-axt1800_firmware | < 3.216 | 3.216 |
| gl-inet | gl-b1300_firmware | < 3.216 | 3.216 |
| gl-inet | gl-b2200_firmware | < 3.216 | 3.216 |
| gl-inet | gl-e750_firmware | < 3.216 | 3.216 |
| gl-inet | gl-mifi_firmware | < 3.216 | 3.216 |
| gl-inet | gl-mt1300_firmware | < 3.216 | 3.216 |
| gl-inet | gl-mt2500_firmware | < 3.216 | 3.216 |
| gl-inet | gl-mt2500a_firmware | < 3.216 | 3.216 |
| gl-inet | gl-mt3000_firmware | < 3.216 | 3.216 |
| gl-inet | gl-mt300n-v2_firmware | < 3.216 | 3.216 |
| gl-inet | gl-mv1000_firmware | < 3.216 | 3.216 |
| gl-inet | gl-mv1000w_firmware | < 3.216 | 3.216 |
| gl-inet | gl-s10_firmware | < 3.216 | 3.216 |
| gl-inet | gl-s1300_firmware | < 3.216 | 3.216 |
| gl-inet | gl-s200_firmware | < 3.216 | 3.216 |
| gl-inet | gl-s20_firmware | < 3.216 | 3.216 |
| gl-inet | gl-sf1200_firmware | < 3.216 | 3.216 |
| gl-inet | gl-sft1200_firmware | < 3.216 | 3.216 |
Detection & IOCsextracted from sources · hover to see the quote
othertitle:"GL.iNet Admin Panel"
- →Send an unauthenticated POST request to /api/router/mesh/status with body 'mac=' and check for JSON fields 'ssid' and 'encryption' in the response body with HTTP 200 status.
- →Response body containing both '"ssid":' and '"encryption":' indicates successful unauthenticated Wi-Fi credential disclosure.
- →Affected GL.iNet devices can be identified via Shodan using the title fingerprint for the admin panel.
- ·The vulnerability affects GL.iNet devices running firmware versions before 3.216. The API endpoint /api/router/mesh/status does not require authentication on vulnerable versions. ↗
- ·The POST body only requires 'mac=' (empty mac parameter) to trigger the disclosure — no credentials or session token needed.
CVSS provenance
nvdv3.17.5HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
vulncheck7.5HIGH
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-grvf-mjv4-48x8: An issue was discovered on GL
ghsa_unreviewed·2023-05-10
CVE-2023-31478 [HIGH] GHSA-grvf-mjv4-48x8: An issue was discovered on GL
An issue was discovered on GL.iNet devices before 3.216. An API endpoint reveals information about the Wi-Fi configuration, including the SSID and key.
VulnCheck
GL.iNet API Endpoint Information Disclosure Vulnerability
vulncheck·2023·CVSS 7.5
CVE-2023-31478 [HIGH] GL.iNet API Endpoint Information Disclosure Vulnerability
GL.iNet API Endpoint Information Disclosure Vulnerability
An issue was discovered on GL.iNet devices before 3.216. An API endpoint reveals information about the Wi-Fi configuration, including the SSID and key.
Affected: gl-inet gl-s20_firmware
Required Action: Apply remediations or mitigations per vendor instructions or discontinue use of the product if remediation or mitigations are unavailable.
Exploitation References: https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2025-03-31&host_type=src&vulnerability=cve-2023-31478; https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2025-04-01&host_type=src&vulnerability=cve-2023-31478; https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2025-04-02&host_type=src&vu
No detection rules found.
Nuclei
GL.iNET SSID Key Disclosure
nuclei·CVSS 7.5
CVE-2023-31478 [HIGH] GL.iNET SSID Key Disclosure
GL.iNET SSID Key Disclosure
An issue was discovered on GL.iNet devices before 3.216. An API endpoint reveals information about the Wi-Fi configuration, including the SSID and key.
Template:
id: CVE-2023-31478
info:
name: GL.iNET SSID Key Disclosure
author: DhiyaneshDK
severity: high
description: |
An issue was discovered on GL.iNet devices before 3.216. An API endpoint reveals information about the Wi-Fi configuration, including the SSID and key.
impact: |
Unauthenticated attackers can retrieve Wi-Fi SSID and password information through the mesh status API endpoint, potentially allowing unauthorized access to the wireless network and intercepting network traffic.
remediation: |
Update GL.iNET firmware to version 3.216 or later that requires authentication for the /api/router/mesh/stat
No writeups or analysis indexed.
2023-05-09
Published
Exploited in the wild