CVE-2023-31478
📋 TL;DR
This vulnerability in GL.iNet devices exposes Wi-Fi configuration details including SSID and encryption keys through an API endpoint. Attackers can retrieve Wi-Fi credentials, potentially gaining unauthorized network access. All GL.iNet device users running firmware versions before 3.216 are affected.
💻 Affected Systems
- GL.iNet routers and networking devices
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Attackers obtain Wi-Fi credentials, gain persistent network access, intercept sensitive traffic, and launch further attacks against connected devices.
Likely Case
Unauthorized users access the Wi-Fi network, potentially monitoring traffic or using the connection for malicious activities.
If Mitigated
With proper network segmentation and access controls, impact is limited to the specific device's Wi-Fi network.
🎯 Exploit Status
Simple HTTP request to the vulnerable API endpoint reveals credentials without authentication.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 3.216 and later
Vendor Advisory: https://github.com/gl-inet/CVE-issues/blob/main/3.215/SSID_Key_Disclosure.md
Restart Required: Yes
Instructions:
1. Log into GL.iNet admin interface. 2. Navigate to System > Firmware Upgrade. 3. Check for updates and install version 3.216 or later. 4. Reboot the device after installation.
🔧 Temporary Workarounds
Disable remote management
allPrevent external access to the vulnerable API endpoint
Network segmentation
allIsolate GL.iNet device management interface from untrusted networks
🧯 If You Can't Patch
- Change Wi-Fi SSID and password immediately
- Disable Wi-Fi and use wired connections only
🔍 How to Verify
Check if Vulnerable:
Check firmware version in admin interface under System > Status. If version is below 3.216, device is vulnerable.Check Version:
curl -s http://router-ip/cgi-bin/api/v3/system/status | grep versionVerify Fix Applied:
Confirm firmware version is 3.216 or higher in System > Status after update.📡 Detection & Monitoring
Log Indicators:
- Unusual API access patterns to configuration endpoints
- Multiple failed authentication attempts followed by successful API calls
Network Indicators:
- HTTP requests to /cgi-bin/api/v3/wireless/ssid_key from unauthorized IPs
- Sudden increase in Wi-Fi configuration API calls
SIEM Query:
source="gl-inet-logs" AND (uri_path="/cgi-bin/api/v3/wireless/ssid_key" OR uri_path="/cgi-bin/api/v3/system/status")