CVE-2023-46456
📋 TL;DR
This vulnerability allows remote attackers to execute arbitrary shell commands on GL.iNET GL-AR300M routers by exploiting improper input validation in the OpenVPN client file upload functionality. Attackers can gain full control of affected routers, potentially compromising network security and connected devices. Only users of GL-AR300M routers with firmware version 3.216 are affected.
💻 Affected Systems
- GL.iNET GL-AR300M
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete router compromise leading to network takeover, credential theft, man-in-the-middle attacks, and lateral movement to connected devices.
Likely Case
Router compromise allowing network monitoring, DNS hijacking, and credential harvesting from connected devices.
If Mitigated
Limited impact if router is behind firewall with restricted WAN access and proper network segmentation.
🎯 Exploit Status
Exploitation requires network access to router's web interface or OpenVPN service.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Firmware version after 3.216
Vendor Advisory: https://www.gl-inet.com/
Restart Required: Yes
Instructions:
1. Log into router admin interface
2. Navigate to System > Firmware
3. Check for updates
4. Install latest firmware
5. Reboot router
🔧 Temporary Workarounds
Disable OpenVPN client
linuxTemporarily disable OpenVPN client functionality to prevent exploitation
uci set openvpn.custom_config.enabled='0'
uci commit openvpn
/etc/init.d/openvpn restart
Restrict web interface access
linuxLimit access to router admin interface to trusted IPs only
iptables -A INPUT -p tcp --dport 80 -s TRUSTED_IP -j ACCEPT
iptables -A INPUT -p tcp --dport 443 -s TRUSTED_IP -j ACCEPT
iptables -A INPUT -p tcp --dport 80 -j DROP
iptables -A INPUT -p tcp --dport 443 -j DROP
🧯 If You Can't Patch
- Place router behind firewall with strict inbound rules blocking all unnecessary ports
- Implement network segmentation to isolate router from critical systems
🔍 How to Verify
Check if Vulnerable:
Check firmware version via web interface at System > Firmware or run 'cat /etc/glversion' on router shellCheck Version:
cat /etc/glversionVerify Fix Applied:
Confirm firmware version is newer than 3.216 and test OpenVPN file upload functionality📡 Detection & Monitoring
Log Indicators:
- Unusual OpenVPN configuration file uploads
- Suspicious shell commands in system logs
- Unexpected process execution
Network Indicators:
- Unusual outbound connections from router
- DNS queries to malicious domains
- Port scanning originating from router
SIEM Query:
source="router.log" AND ("openvpn" AND "upload") OR ("sh" AND "-c")