CVE-2023-46454
📋 TL;DR
This vulnerability allows remote attackers to execute arbitrary shell commands on GL.iNET GL-AR300M routers by injecting malicious commands into package names. Attackers can gain full control of affected devices, potentially compromising network security. Only users of GL-AR300M routers with firmware version 4.3.7 are affected.
💻 Affected Systems
- GL.iNET GL-AR300M
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete device takeover leading to network compromise, data exfiltration, lateral movement to other devices, and persistent backdoor installation.
Likely Case
Router compromise allowing traffic interception, credential theft, DNS hijacking, and use as attack platform.
If Mitigated
Limited impact if device is isolated, has strict network controls, and command injection attempts are blocked.
🎯 Exploit Status
The vulnerability is in package information functionality and requires no authentication. Public technical details available in referenced blog posts.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Firmware version after 4.3.7 (check vendor for latest)
Vendor Advisory: https://www.gl-inet.com/security/
Restart Required: Yes
Instructions:
1. Log into router admin interface. 2. Navigate to System > Firmware Upgrade. 3. Check for updates and install latest firmware. 4. Reboot router after update completes.
🔧 Temporary Workarounds
Disable remote management
linuxPrevent external access to router management interface
uci set firewall.@zone[1].input='REJECT'
uci commit firewall
/etc/init.d/firewall restart
Block package management access
linuxRestrict access to package information functionality via firewall rules
iptables -A INPUT -p tcp --dport 80 -j DROP
iptables -A INPUT -p tcp --dport 443 -j DROP
🧯 If You Can't Patch
- Isolate router on separate VLAN with strict network segmentation
- Implement network monitoring for command injection patterns and shell execution attempts
🔍 How to Verify
Check if Vulnerable:
Check firmware version via web interface at System > Status or run 'cat /etc/glversion' on device shellCheck Version:
cat /etc/glversion || uci get system.@system[0].firmware_versionVerify Fix Applied:
Confirm firmware version is greater than 4.3.7 and test package functionality with safe commands📡 Detection & Monitoring
Log Indicators:
- Unusual package installation attempts
- Shell command execution in system logs
- Suspicious characters in package names (;, |, &, $)
Network Indicators:
- HTTP requests to package endpoints with command injection patterns
- Outbound connections from router to unexpected destinations
SIEM Query:
source="router.log" AND ("package" AND ("|" OR ";" OR "$" OR "&"))