CVE-2023-50445: OS Command Injection
Shell Injection vulnerability GL.iNet A1300 v4.4.6, AX1800 v4.4.6, AXT1800 v4.4.6, MT3000 v4.4.6, MT2500 v4.4.6, MT6000 v4.5.0, MT1300 v4.3.7, MT300N-V2 v4.3.7, AR750S v4.3.7, AR750 v4.3.7, AR300M v4.3.7, and B1300 v4.3.7., allows local attackers to execute arbitrary code via the getsystemlog and getcrashlog functions of the logread module, as well as the upgradeonline function of the upgrade module.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2023-50445?
CVE-2023-50445 has been assigned a severity rating due to its potential for local code execution via shell injection.
How do I fix CVE-2023-50445?
To fix CVE-2023-50445, update to the latest firmware version provided by GL.iNet that addresses this vulnerability.
What systems are affected by CVE-2023-50445?
Devices affected by CVE-2023-50445 include GL.iNet A1300 v4.4.6, AX1800 v4.4.6, MT3000 v4.4.6, and several other models, primarily those with specific firmware versions.
Can CVE-2023-50445 be exploited remotely?
CVE-2023-50445 requires local access to the device, which limits its exploitation level to users with physical access.
What are the consequences of exploiting CVE-2023-50445?
Exploiting CVE-2023-50445 can allow an attacker to execute arbitrary commands on the vulnerable device, potentially compromising its functionality and security.