CVE-2023-50445 Overview
CVE-2023-50445 is a shell injection vulnerability affecting multiple GL.iNet router firmware versions. The flaw resides in the get_system_log and get_crash_log functions of the logread module, as well as the upgrade_online function of the upgrade module. Local authenticated attackers can inject shell metacharacters through these API endpoints to execute arbitrary commands on the underlying operating system. The vulnerability is classified under CWE-78 (OS Command Injection) and CWE-77 (Command Injection).
Critical Impact
Successful exploitation grants attackers arbitrary code execution on the router, compromising the confidentiality, integrity, and availability of the device and the network it manages.
Affected Products
- GL.iNet A1300, AX1800, AXT1800, MT3000, MT2500 firmware v4.4.6
- GL.iNet MT6000 firmware v4.5.0
- GL.iNet MT1300, MT300N-V2, AR750S, AR750, AR300M, B1300 firmware v4.3.7
Discovery Timeline
- 2023-12-28 - CVE-2023-50445 published to NVD
- 2024-11-21 - Last updated in NVD database
Technical Details for CVE-2023-50445
Vulnerability Analysis
The vulnerability stems from improper neutralization of shell metacharacters in user-controlled input passed to operating system commands. GL.iNet routers expose API endpoints backed by the logread and upgrade modules. These endpoints accept parameters that are concatenated into shell commands without sanitization. An authenticated local attacker can submit crafted requests containing metacharacters such as backticks, semicolons, or pipes to break out of the intended command context.
Root Cause
The root cause is missing input validation in the get_system_log and get_crash_log functions of the logread module and the upgrade_online function of the upgrade module. These functions construct shell commands using attacker-supplied parameters and pass them to a system shell interpreter. Without metacharacter filtering or argument escaping, any shell control character in the input becomes part of the executed command line.
Attack Vector
An attacker with local network access and valid credentials sends an API request to one of the affected endpoints. The injected payload uses shell metacharacters to append commands that the router executes with the privileges of the web service process. Because GL.iNet routers run most services as root, successful injection typically yields full administrative control over the device, allowing traffic interception, firmware tampering, and lateral movement.
For technical exploitation details, see the Packet Storm Exploit Report and the GitHub CVE Issue Documentation.
Detection Methods for CVE-2023-50445
Indicators of Compromise
- Unexpected child processes spawned by the router's web service (uhttpd, nginx, or lua runtime) executing shell utilities like sh, wget, curl, or nc.
- API requests to logread or upgrade endpoints containing shell metacharacters such as ;, |, &&, `, or $(...).
- New or modified files in /tmp, /etc, or persistent overlay directories following administrative API access.
Detection Strategies
- Inspect router web access logs for requests targeting get_system_log, get_crash_log, or upgrade_online endpoints with suspicious parameter values.
- Correlate authenticated API sessions with subsequent outbound network connections from the router itself.
- Compare firmware integrity hashes against vendor-published values to identify tampering after suspected exploitation.
Monitoring Recommendations
- Forward router syslog data to a centralized SIEM and alert on shell metacharacter patterns in API parameters.
- Monitor for anomalous outbound DNS, HTTP, or SSH connections originating from router management interfaces.
- Track configuration changes and account additions on the router management console.
How to Mitigate CVE-2023-50445
Immediate Actions Required
- Upgrade affected GL.iNet devices to firmware versions released after the v4.4.6 and v4.5.0 baselines that address this issue.
- Rotate all administrative credentials on affected routers after patching.
- Restrict access to the router web administration interface to trusted management VLANs only.
Patch Information
GL.iNet publishes firmware updates through its official download portal. Administrators should consult the GitHub CVE Issue Documentation to confirm the fixed version corresponding to each device model and apply the latest stable release.
Workarounds
- Disable remote management features and block external access to the router administrative API.
- Limit administrative account access to a minimal set of trusted operators and enforce strong, unique passwords.
- Segment the router management network from general user traffic to reduce local attacker exposure.
# Configuration example: restrict management interface to a trusted subnet
uci set firewall.@zone[0].input='DROP'
uci add firewall rule
uci set firewall.@rule[-1].name='Allow-Mgmt-Subnet'
uci set firewall.@rule[-1].src='lan'
uci set firewall.@rule[-1].src_ip='192.168.10.0/24'
uci set firewall.@rule[-1].dest_port='80 443'
uci set firewall.@rule[-1].target='ACCEPT'
uci commit firewall
/etc/init.d/firewall restart
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
