CVE-2023-31476

Severity: high (CVSS 7.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.8% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2023-05-09 · updated 2026-06-17
Weakness: CWE-77

Description

An issue was discovered on GL.iNet devices running firmware before 3.216. There is an arbitrary file write in which an empty file can be created almost anywhere on the filesystem, as long as the filename and path is no more than 6 characters (the working directory is /www).

Affected products

GL-iNet Gl-Mv1000 Firmware: through 3.215
GL-iNet Gl-Mv1000W Firmware: through 3.215

References

https://github.com/gl-inet/CVE-issues/blob/main/3.215/GL-MV1000_Arbitrary_File_Creation.md
https://www.gl-inet.com
https://github.com/gl-inet/CVE-issues/blob/main/3.215/GL-MV1000_Arbitrary_File_Creation.md
https://www.gl-inet.com

Get alerted when CVE-2023-31476 or the next vulnerability affects your stack