CVE-2023-46454: Gl-Inet Gl-AR300M Firmware

Critical severity, CVSS 9.8. EPSS: 23.5% chance of exploitation in the next 30 days.

In GL.iNET GL-AR300M routers with firmware v4.3.7, it is possible to inject arbitrary shell commands through a crafted package name in the package information functionality.

Affected products

• Gl-Inet Gl-AR300M Firmware: version 4.3.7 only

Published 2023-12-12. Last modified 2026-06-17.