CVE-2023-46454: OS Command Injection
Published Dec 12, 2023
·Updated
In GL.iNET GL-AR300M routers with firmware v4.3.7, it is possible to inject arbitrary shell commands through a crafted package name in the package information functionality.
Affected Software
2 affected components
All of the following
gl-inet Gl-ar300m Firmware=4.3.7
gl-inet Gl-ar300m
Event History
Dec 12, 2023
CVE Published
12:00 AM
Data Sourced
12:00 AM
Description
Frequently Asked Questions
1
What is the severity of CVE-2023-46454?
CVE-2023-46454 has been classified as a critical vulnerability due to its potential for remote code execution.
2
How do I fix CVE-2023-46454?
To fix CVE-2023-46454, you should upgrade the GL.iNET GL-AR300M firmware to the latest version provided by the vendor.
3
What are the impacts of CVE-2023-46454?
The impacts of CVE-2023-46454 include the possibility for attackers to execute arbitrary shell commands on affected routers.
4
Who is affected by CVE-2023-46454?
CVE-2023-46454 affects users of GL.iNET GL-AR300M routers running firmware version 4.3.7.
5
Is there a workaround for CVE-2023-46454?
There are no known effective workarounds for CVE-2023-46454; updating the firmware is recommended.