CVE-2023-31478

HIGHNuclei

GL.iNet API Endpoint Information Disclosure Vulnerability

Title source: VulnCheck
STIX 2.1 vulnerability

Record summary

CVE-2023-31478 has a selected CVSS score of 7.5 (high); EIP currently links 1 Nuclei template.

Description

An issue was discovered on GL.iNet devices before 3.216. An API endpoint reveals information about the Wi-Fi configuration, including the SSID and key.

Description source: CVE List

Exploitation context

Known exploitation

VulnCheck KEV
Listed · Mar 31, 2025 · VulnCheck
Reported exploitation
Observed · VulnCheck

Available material

Nuclei templates
1

CISA SSVC decision

ExploitationPoC
AutomatableNo
Technical impactPartial

CISA Coordinator · SSVC 2.0.3 · Evaluated Jan 29, 2025 · Source: CVE List

Affected products and versions

1
ProductSourceVersion range

gl-s20_firmware

Browse gl-inet / gl-s20_firmware
VulnCheckVersion data not supplied

Nuclei templates

1
ProjectDiscoveryHIGHGL.iNET SSID Key DisclosureCVSS 7.5

An issue was discovered on GL.iNet devices before 3.216. An API endpoint reveals information about the Wi-Fi configuration, including the SSID and key.

Impact

Unauthenticated attackers can retrieve Wi-Fi SSID and password information through the mesh status API endpoint, potentially allowing unauthorized access to the wireless network and intercepting network traffic.

Remediation

Update GL.iNET firmware to version 3.216 or later that requires authentication for the /api/router/mesh/status endpoint and protects Wi-Fi credentials.

AuthorsDhiyaneshDK
Template tagscvecve2023gl-inetdisclosurevkevvuln
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
CPE: cpe:2.3:o:gl-inet:gl-s20_firmware:*:*:*:*:*:*:*:*
Shodan: title:"GL.iNet Admin Panel"
https://www.gl-inet.com/

Source: ProjectDiscovery

References

3