CVE-2023-50445 Command injection in n/a

High 7.8 Published 28 Dec 2023 Updated 2 Aug 2024

Local attackers can execute arbitrary code on GL.iNet routers via shell injection in log and upgrade modules.

Exploited in the wild: Not known
Login needed: Any signed-in user
Attackable: Local or same network only
Victim action needed: Not needed
Fix: None listed

What is CVE-2023-50445?

CVE-2023-50445 is a high-severity command injection vulnerability in n/a, published on 28 Dec 2023. It can only be exploited from the same machine or local network, with no action from the victim.

Official description

Shell Injection vulnerability GL.iNet A1300 v4.4.6, AX1800 v4.4.6, AXT1800 v4.4.6, MT3000 v4.4.6, MT2500 v4.4.6, MT6000 v4.5.0, MT1300 v4.3.7, MT300N-V2 v4.3.7, AR750S v4.3.7, AR750 v4.3.7, AR300M v4.3.7, and B1300 v4.3.7., allows local attackers to execute arbitrary code via the get_system_log and get_crash_log functions of the logread module, as well as the upgrade_online function of the upgrade module.

Weakness: CWE-78, CWE-77

Which versions are affected by CVE-2023-50445?

It affects 12 products.

Products include Gl-Inet Gl-A1300 Firmware, Gl-Inet Gl-Ar300m Firmware, Gl-Inet Gl-Ar750 Firmware, Gl-Inet Gl-Ar750s Firmware, Gl-Inet Gl-Ax1800 Firmware, Gl-Inet Gl-Axt1800 Firmware and 6 more.

How do I fix CVE-2023-50445?

No fix has been published for CVE-2023-50445 yet. Limit exposure of the affected software until one is available.

Upgrade, and pass arguments to programs as a list instead of through a shell. More about Command injection.

Is CVE-2023-50445 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2023-50445 exists.

Public exploit code: 1 Metasploit module.

Sources

Also known as GHSA-r64h-95wm-rrfq.