CVE-2023-29778
📋 TL;DR
CVE-2023-29778 allows remote attackers to execute arbitrary operating system commands on GL.iNET MT3000 routers via command injection in the logread RPC endpoint. This vulnerability affects all users running vulnerable firmware versions, potentially giving attackers full control of affected devices.
💻 Affected Systems
- GL.iNET MT3000
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete device compromise allowing attackers to install persistent backdoors, intercept network traffic, pivot to internal networks, or use device as botnet node.
Likely Case
Remote code execution leading to device takeover, credential theft, and network surveillance.
If Mitigated
Limited impact if device is behind firewall with restricted WAN access and proper network segmentation.
🎯 Exploit Status
Public proof-of-concept demonstrates remote exploitation via HTTP request to vulnerable endpoint.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Versions after 4.1.0 Release 2
Vendor Advisory: http://glinet.com
Restart Required: Yes
Instructions:
1. Log into router admin interface. 2. Navigate to System > Firmware. 3. Check for updates and install latest version. 4. Reboot router after update completes.
🔧 Temporary Workarounds
Disable web interface access
linuxTemporarily disable the vulnerable web interface component
/etc/init.d/oui-httpd stop
/etc/init.d/oui-httpd disable
Restrict network access
linuxConfigure firewall to block external access to router web interface
iptables -A INPUT -p tcp --dport 80 -j DROP
iptables -A INPUT -p tcp --dport 443 -j DROP
🧯 If You Can't Patch
- Isolate affected devices in separate VLAN with strict firewall rules
- Implement network monitoring for exploitation attempts and unusual outbound connections
🔍 How to Verify
Check if Vulnerable:
Check if /usr/lib/oui-httpd/rpc/logread endpoint accepts command injection via crafted HTTP requestsCheck Version:
cat /etc/glversionVerify Fix Applied:
Verify firmware version is newer than 4.1.0 Release 2 and test endpoint no longer executes injected commands📡 Detection & Monitoring
Log Indicators:
- Unusual commands in system logs
- HTTP requests to /usr/lib/oui-httpd/rpc/logread with shell metacharacters
Network Indicators:
- HTTP POST requests to logread endpoint containing pipe characters or semicolons
- Unexpected outbound connections from router
SIEM Query:
source="router_logs" AND (url="/usr/lib/oui-httpd/rpc/logread" AND (request CONTAINS "|" OR request CONTAINS ";" OR request CONTAINS "`"))