What is CVE-2023-31476?

CVE-2023-31476 is an arbitrary file write vulnerability on GL.iNet devices running firmware before 3.216.

How does CVE-2023-31476 work?

CVE-2023-31476 allows an attacker to create an empty file with a filename and path of up to 6 characters almost anywhere on the filesystem, as long as the working directory is /www.

Which GL.iNet devices are affected by CVE-2023-31476?

GL-MV1000W Firmware versions up to 3.215 and GL-MV1000 Firmware versions up to 3.215 are affected by CVE-2023-31476.

What is the severity of CVE-2023-31476?

CVE-2023-31476 has a severity level of 7.5 (High).

How can I fix CVE-2023-31476?

To fix CVE-2023-31476, update your GL.iNet device firmware to version 3.216 or later.

Vulnerability/
CVE-2023-31476

high

7.5

CWE

9/5/2023

29/1/2025

CVE-2023-31476: Command Injection

First published: Tue May 09 2023(Updated: )

An issue was discovered on GL.iNet devices running firmware before 3.216. There is an arbitrary file write in which an empty file can be created almost anywhere on the filesystem, as long as the filename and path is no more than 6 characters (the working directory is /www).

Credit: cve@mitre.org

Affected Software	Affected Version	How to fix
All of
gl-inet gl-mv1000 firmware	<=3.215
GL.iNet GL-MV1000W
All of
GL.iNet GL-MV1000 Firmware	<=3.215
GL.iNet GL-MV1000
gl-inet gl-mv1000 firmware	<=3.215
GL.iNet GL-MV1000W
GL.iNet GL-MV1000 Firmware	<=3.215
GL.iNet GL-MV1000

Never miss a vulnerability like this again

Reference Links

Frequently Asked Questions

What is CVE-2023-31476?
CVE-2023-31476 is an arbitrary file write vulnerability on GL.iNet devices running firmware before 3.216.
How does CVE-2023-31476 work?
CVE-2023-31476 allows an attacker to create an empty file with a filename and path of up to 6 characters almost anywhere on the filesystem, as long as the working directory is /www.
Which GL.iNet devices are affected by CVE-2023-31476?
GL-MV1000W Firmware versions up to 3.215 and GL-MV1000 Firmware versions up to 3.215 are affected by CVE-2023-31476.
What is the severity of CVE-2023-31476?
CVE-2023-31476 has a severity level of 7.5 (High).
How can I fix CVE-2023-31476?
To fix CVE-2023-31476, update your GL.iNet device firmware to version 3.216 or later.

agent/references
agent/type
collector/mitre-cve
source/MITRE
agent/severity
agent/weakness
agent/last-modified-date
agent/source
agent/description
agent/first-publish-date
agent/softwarecombine
agent/tags
agent/event
collector/nvd-api
source/NVD
agent/software-canonical-lookup
agent/software-canonical-lookup-request
collector/nvd-index
agent/author
vendor/gl-inet
canonical/gl-inet gl-mv1000 firmware
version/gl-inet gl-mv1000 firmware/3.215
canonical/gl.inet gl-mv1000w
canonical/gl.inet gl-mv1000 firmware
version/gl.inet gl-mv1000 firmware/3.215
canonical/gl.inet gl-mv1000

Company

Resources

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co

By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.