CVE-2023-46454

published 2023-12-12

CVE-2023-46454: In GL.iNET GL-AR300M routers with firmware v4.3.7, it is possible to inject arbitrary shell commands through a crafted package name in the package information…

Priority P2 73 critical 9.8 CVSS 3.1

AV N AC L PR N UI N S U C H I H A H

EXPLOIT

In GL.iNET GL-AR300M routers with firmware v4.3.7, it is possible to inject arbitrary shell commands through a crafted package name in the package information functionality.

Affected

1 ranges

Vendor	Product	Version range	Fixed in
gl-inet	gl-ar300m_firmware	—	—

Detection & IOCs extracted from sources · hover to see the quote

url /rpc↗

path /tmp/f↗

version GL-AR300M firmware v4.3.7↗

• → Shell command injection via crafted package name in the package information functionality — monitor RPC endpoint for package name fields containing shell metacharacters (e.g., |, ;, &, $(), backticks). ↗
• → Exploit delivers a netcat-based reverse shell writing to /tmp/f; monitor for creation of /tmp/f on GL.iNET devices and outbound nc connections originating from the router process. ↗
• → Exploitation targets the /rpc HTTP endpoint on GL-AR300M routers; inspect POST requests to /rpc for anomalous package name values containing shell injection strings. ↗

• · Exploitation requires a valid auth_token, meaning the attacker must first authenticate (or obtain credentials) before triggering the RCE via the /rpc endpoint. ↗
• · Vulnerability is confirmed only on GL-AR300M routers running firmware version 4.3.7; other firmware versions are not confirmed affected by this source. ↗

CVEs like this are exactly what “Exploited This Week” covers.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-78