CVE-2023-31471
📋 TL;DR
This vulnerability allows attackers to install arbitrary software on GL.iNet devices by bypassing client-side package verification. It enables remote code execution through the software installation feature, affecting all GL.iNet devices running firmware versions before 3.216.
💻 Affected Systems
- GL.iNet routers and networking devices
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Full device compromise with persistent backdoor installation, data exfiltration, and use as pivot point in network attacks.
Likely Case
Installation of reverse shells or malware leading to unauthorized access and control of affected devices.
If Mitigated
Limited impact if network segmentation and access controls prevent exploitation attempts.
🎯 Exploit Status
Exploitation is straightforward as it bypasses client-side checks only.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 3.216 and later
Vendor Advisory: https://www.gl-inet.com
Restart Required: Yes
Instructions:
1. Log into GL.iNet admin interface. 2. Navigate to System > Firmware Upgrade. 3. Check for updates and install version 3.216 or later. 4. Reboot device after installation.
🔧 Temporary Workarounds
Disable software installation feature
allTemporarily disable the vulnerable software installation functionality
# Access GL.iNet web interface
# Navigate to Software > Package Manager
# Disable or restrict installation options
Network access restrictions
linuxRestrict access to device administration interface
# Configure firewall rules to limit admin access
# iptables -A INPUT -p tcp --dport 80 -s trusted_ip -j ACCEPT
# iptables -A INPUT -p tcp --dport 443 -s trusted_ip -j ACCEPT
🧯 If You Can't Patch
- Isolate vulnerable devices in separate network segment with strict firewall rules
- Implement network monitoring for unusual outbound connections from GL.iNet devices
🔍 How to Verify
Check if Vulnerable:
Check firmware version in GL.iNet admin interface under System > StatusCheck Version:
ssh admin@device_ip 'cat /etc/glversion'Verify Fix Applied:
Confirm firmware version is 3.216 or higher after update📡 Detection & Monitoring
Log Indicators:
- Unusual package installation logs
- Unexpected software installation attempts
- Failed authentication to software repository
Network Indicators:
- Outbound connections from device to unknown IPs
- Unusual traffic patterns after software installation
SIEM Query:
source="gl-inet-logs" AND (event="package_install" OR event="software_update") AND NOT user="authorized_user"