CVE-2023-31474: Gl-Inet Gl-a1300 Firmware

High severity, CVSS 7.5. EPSS: 0.8% chance of exploitation in the next 30 days.

An issue was discovered on GL.iNet devices before 3.216. Through the software installation feature, it is possible to inject arbitrary parameters in a request to cause opkg to obtain a list of files in a specific directory, by using the regex feature in a package name.

Affected products

• Gl-Inet Gl-a1300 Firmware: before 3.216 (fixed in 3.216)
• Gl-Inet Gl-AP1300 Firmware: before 3.216 (fixed in 3.216)
• Gl-Inet Gl-AP1300LTE Firmware: before 3.216 (fixed in 3.216)
• Gl-Inet Gl-AR300M Firmware: before 3.216 (fixed in 3.216)
• Gl-Inet Gl-AR750 Firmware: before 3.216 (fixed in 3.216)
• Gl-Inet Gl-AR750S Firmware: before 3.216 (fixed in 3.216)
• Gl-Inet Gl-AX1800 Firmware: before 3.216 (fixed in 3.216)
• Gl-Inet Gl-AXT1800 Firmware: before 3.216 (fixed in 3.216)
• Gl-Inet Gl-b1300 Firmware: before 3.216 (fixed in 3.216)
• Gl-Inet Gl-b2200 Firmware: before 3.216 (fixed in 3.216)
• Gl-Inet Gl-e750 Firmware: before 3.216 (fixed in 3.216)
• Gl-Inet Gl-Mifi Firmware: before 3.216 (fixed in 3.216)
• Gl-Inet Gl-MT1300 Firmware: before 3.216 (fixed in 3.216)
• Gl-Inet Gl-MT2500 Firmware: before 3.216 (fixed in 3.216)
• Gl-Inet Gl-MT2500A Firmware: before 3.216 (fixed in 3.216)
• Gl-Inet Gl-MT3000 Firmware: before 3.216 (fixed in 3.216)
• Gl-Inet Gl-MT300N-v2 Firmware: before 3.216 (fixed in 3.216)
• Gl-Inet Gl-MV1000 Firmware: before 3.216 (fixed in 3.216)
• Gl-Inet Gl-MV1000W Firmware: before 3.216 (fixed in 3.216)
• Gl-Inet Gl-s10 Firmware: before 3.216 (fixed in 3.216)
• Gl-Inet Gl-s1300 Firmware: before 3.216 (fixed in 3.216)
• Gl-Inet Gl-s200 Firmware: before 3.216 (fixed in 3.216)
• Gl-Inet Gl-s20 Firmware: before 3.216 (fixed in 3.216)
• Gl-Inet Gl-SF1200 Firmware: before 3.216 (fixed in 3.216)
• Gl-Inet Gl-SFT1200 Firmware: before 3.216 (fixed in 3.216)
• and 7 more

Published 2023-05-09. Last modified 2026-06-17.