Critical · published August 6, 2024
🚨 A sneaky shell injection vulnerability lurks in multiple GL-iNet products, and it could let an attacker execute arbitrary code just by exploiting the configuration interfaces! 🔥 Think of it like a sneaky malware that sneaks in during a routine inspection of your security system, pretending to be part of the setup while actually giving intruders a secret entrance into your home. It's like a contractor who installs a hidden door without your permission! If exploited, an attacker could potentially take full control of the device, altering configurations, intercepting sensitive data, or launching further attacks on your network. This could lead to devastating consequences like data breaches or even full network compromise, putting your entire home or business at risk!
Think of it like a sneaky malware that sneaks in during a routine inspection of your security system, pretending to be part of the setup while actually giving intruders a secret entrance into your home. It's like a contractor who installs a hidden door without your permission! This vulnerability allows attackers to perform shell injection through the `check_ovpn_client_config` and `check_config` interfaces, enabling them to execute arbitrary commands on vulnerable GL-iNet devices. Affected versions include AR750/AR750S/AR300M, MT300N-V2, and several others, all running specific versions listed in the CVE.
If exploited, an attacker could potentially take full control of the device, altering configurations, intercepting sensitive data, or launching further attacks on your network. This could lead to devastating consequences like data breaches or even full network compromise, putting your entire home or business at risk! To protect your network, immediately update your GL-iNet devices to the patched versions: AR750/AR750S/AR300M/AR300M16/MT300N-V2/B1300/MT1300/SFT1200/X750 to v4.3.12 or later, and MT3000/MT2500/AXT1800/AX1800/A1300/X300B to v4.5.17. Regularly audit your device configurations and ensure that untrusted inputs cannot be injected into the command interfaces. You've got this! Follow these steps, and you'll be back on track—your digital fortress will be stronger than ever! 🛡️