Shell Injection vulnerability GL.iNet A1300 v4.4.6, AX1800 v4.4.6, AXT1800 v4.4.6, MT3000 v4.4.6, MT2500 v4.4.6, MT6000 v4.5.0, MT1300 v4.3.7, MT300N-V2 v4.3.7, AR750S v4.3.7, AR750 v4.3.7, AR300M v4.3.7, and B1300 v4.3.7., allows local attackers to execute arbitrary code via the get_system_log and get_crash_log functions of the logread module, as well as the upgrade_online function of the upgrade module.

No CVSS v4.0

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.02277.

Exploitation none

Automatable no

Technical Impact total

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions
n/a n/a affected
Version Status Constraints
n/a affected —

Configuration 1 [-]

AND
cpe:2.3:o:gl-inet:gl-mt1300_firmware:4.3.7:*:*:*:*:*:*:*
cpe:2.3:h:gl-inet:gl-mt1300:-:*:*:*:*:*:*:*

Configuration 2 [-]

AND
cpe:2.3:o:gl-inet:gl-mt300n-v2_firmware:4.3.7:*:*:*:*:*:*:*
cpe:2.3:h:gl-inet:gl-mt300n-v2:-:*:*:*:*:*:*:*

Configuration 3 [-]

AND
cpe:2.3:o:gl-inet:gl-ar750s_firmware:4.3.7:*:*:*:*:*:*:*
cpe:2.3:h:gl-inet:gl-ar750s:-:*:*:*:*:*:*:*

Configuration 4 [-]

AND
cpe:2.3:o:gl-inet:gl-ar750_firmware:4.3.7:*:*:*:*:*:*:*
cpe:2.3:h:gl-inet:gl-ar750:-:*:*:*:*:*:*:*

Configuration 5 [-]

AND
cpe:2.3:o:gl-inet:gl-ar300m_firmware:4.3.7:*:*:*:*:*:*:*
cpe:2.3:h:gl-inet:gl-ar300m:-:*:*:*:*:*:*:*

Configuration 6 [-]

AND
cpe:2.3:o:gl-inet:gl-b1300_firmware:4.3.7:*:*:*:*:*:*:*
cpe:2.3:h:gl-inet:gl-b1300:-:*:*:*:*:*:*:*

Configuration 7 [-]

AND
cpe:2.3:o:gl-inet:gl-mt6000_firmware:4.5.0:*:*:*:*:*:*:*
cpe:2.3:h:gl-inet:gl-mt6000:-:*:*:*:*:*:*:*

Configuration 8 [-]

AND
cpe:2.3:o:gl-inet:gl-a1300_firmware:4.4.6:*:*:*:*:*:*:*
cpe:2.3:h:gl-inet:gl-a1300:-:*:*:*:*:*:*:*

Configuration 9 [-]

AND
cpe:2.3:o:gl-inet:gl-ax1800_firmware:4.4.6:*:*:*:*:*:*:*
cpe:2.3:h:gl-inet:gl-ax1800:-:*:*:*:*:*:*:*

Configuration 10 [-]

AND
cpe:2.3:o:gl-inet:gl-axt1800_firmware:4.4.6:*:*:*:*:*:*:*
cpe:2.3:h:gl-inet:gl-axt1800:-:*:*:*:*:*:*:*

Configuration 11 [-]

AND
cpe:2.3:o:gl-inet:gl-mt3000_firmware:4.4.6:*:*:*:*:*:*:*
cpe:2.3:h:gl-inet:gl-mt3000:-:*:*:*:*:*:*:*

Configuration 12 [-]

AND
cpe:2.3:o:gl-inet:gl-mt2500_firmware:4.4.6:*:*:*:*:*:*:*
cpe:2.3:h:gl-inet:gl-mt2500:-:*:*:*:*:*:*:*

No data.

No data.

Project Subscriptions

Vendors Products
Gl-inet Subscribe
Gl-a1300 Subscribe
Gl-a1300 Firmware Subscribe
Gl-ar300m Subscribe
Gl-ar300m Firmware Subscribe
Gl-ar750 Subscribe
Gl-ar750 Firmware Subscribe
Gl-ar750s Subscribe
Gl-ar750s Firmware Subscribe
Gl-ax1800 Subscribe
Gl-ax1800 Firmware Subscribe
Gl-axt1800 Subscribe
Gl-axt1800 Firmware Subscribe
Gl-b1300 Subscribe
Gl-b1300 Firmware Subscribe
Gl-mt1300 Subscribe
Gl-mt1300 Firmware Subscribe
Gl-mt2500 Subscribe
Gl-mt2500 Firmware Subscribe
Gl-mt3000 Subscribe
Gl-mt3000 Firmware Subscribe
Gl-mt300n-v2 Subscribe
Gl-mt300n-v2 Firmware Subscribe
Gl-mt6000 Subscribe
Gl-mt6000 Firmware Subscribe
Gl.inet Subscribe
A1300 Subscribe
Ar300m Subscribe
Ar750 Subscribe
Ar750s Subscribe
Ax1800 Subscribe
Axt1800 Subscribe
B1300 Subscribe
Mt1300 Subscribe
Mt2500 Subscribe
Mt3000 Subscribe
Mt300n V2 Subscribe
Mt6000 Subscribe
Advisories

No advisories yet.

Fixes

Solution

No solution given by the vendor.

Workaround

No workaround given by the vendor.

References
Link Providers
http://packetstormsecurity.com/files/176708/GL.iNet-Unauthenticated-Remote-Command-Execution.html cve-icon cve-icon
https://github.com/gl-inet/CVE-issues/blob/main/4.0.0/Using%20Shell%20Metacharacter%20Injection%20via%20API.md cve-icon cve-icon
History

Thu, 26 Feb 2026 13:15:00 +0000

Type Values Removed Values Added
First Time appeared Gl.inet
Gl.inet a1300
Gl.inet ar300m
Gl.inet ar750
Gl.inet ar750s
Gl.inet ax1800
Gl.inet axt1800
Gl.inet b1300
Gl.inet mt1300
Gl.inet mt2500
Gl.inet mt3000
Gl.inet mt300n V2
Gl.inet mt6000
CPEs cpe:2.3:h:gl.inet:A1300:-:*:*:*:*:*:*:*
cpe:2.3:h:gl.inet:AR300M:-:*:*:*:*:*:*:*
cpe:2.3:h:gl.inet:AR750:-:*:*:*:*:*:*:*
cpe:2.3:h:gl.inet:AR750S:-:*:*:*:*:*:*:*
cpe:2.3:h:gl.inet:AX1800:-:*:*:*:*:*:*:*
cpe:2.3:h:gl.inet:AXT1800:-:*:*:*:*:*:*:*
cpe:2.3:h:gl.inet:B1300:-:*:*:*:*:*:*:*
cpe:2.3:h:gl.inet:MT1300:-:*:*:*:*:*:*:*
cpe:2.3:h:gl.inet:MT2500:-:*:*:*:*:*:*:*
cpe:2.3:h:gl.inet:MT3000:-:*:*:*:*:*:*:*
cpe:2.3:h:gl.inet:MT300N_V2:-:*:*:*:*:*:*:*
cpe:2.3:h:gl.inet:MT6000:-:*:*:*:*:*:*:*
Vendors & Products Gl.inet
Gl.inet a1300
Gl.inet ar300m
Gl.inet ar750
Gl.inet ar750s
Gl.inet ax1800
Gl.inet axt1800
Gl.inet b1300
Gl.inet mt1300
Gl.inet mt2500
Gl.inet mt3000
Gl.inet mt300n V2
Gl.inet mt6000
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Projects

Sign in to view the affected projects.

cve-icon MITRE

Status: PUBLISHED

Assigner: mitre

Published:

Updated: 2024-08-02T22:16:46.684Z

Reserved: 2023-12-10T00:00:00.000Z

Link: CVE-2023-50445

cve-icon Vulnrichment

Updated: 2024-08-02T22:16:46.684Z

cve-icon NVD

Status : Modified

Published: 2023-12-28T05:15:08.427

Modified: 2024-11-21T08:37:00.550

Link: CVE-2023-50445

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

No data.

Weaknesses