CVE-2023-47464

Severity: high (CVSS 8.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 22.6% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2023-11-30 · updated 2026-06-17
Weakness: CWE-22

Description

Insecure Permissions vulnerability in GL.iNet AX1800 version 4.0.0 before 4.5.0 allows a remote attacker to execute arbitrary code via the upload API function.

Affected products

GL-iNet Gl-Ax1800 Firmware: from 4.0.0 before 4.5.0 — fixed in 4.5.0

How to fix

Upgrade to a fixed version: GL-iNet Gl-Ax1800 Firmware 4.5.0. Check the vendor advisory for mitigations.

References

https://github.com/gl-inet/CVE-issues/blob/main/4.0.0/Arbitrary%20File%20Creation%20Through%20API%20upload.md
https://github.com/gl-inet/CVE-issues/blob/main/4.0.0/Arbitrary%20File%20Creation%20Through%20API%20upload.md

Get alerted when CVE-2023-47464 or the next vulnerability affects your stack