Back

CVE-2023-31478: An issue was discovered on GL.iNet devices before 3.216. An ..

gl-inet

•

May 9, 2023

•

May 17, 2023

High

7.5

/

10

Description

An issue was discovered on GL.iNet devices before 3.216. An API endpoint reveals information about the Wi-Fi configuration, including the SSID and key.

Products affected:

Resources

Are your APIs vulnerable to this CWE?

Are your APIs vulnerable to this CWE?

Are your APIs vulnerable to this CWE?

In a few clicks Akto can analyze your API attack surface and see what APIs are vulnerable to OWASP Top 10 and other common CWEs.

Akto BG image
Akto BG image
Akto BG image

Severity

High

High

7.5

/

10

CVSS base metrics

Attack vector

NETWORK

Attack complexity

LOW

Privileges required

LOW

User interaction

NONE

Scope

UNCHANGED

Confidentiality

HIGH

Integrity

NONE

Availability

NONE

Exploitability Score

3.9

Impact Score

3.6

Weakness

NVD-CWE-noinfo__

Source

National Vulnerability Database

Learn from academy

Docker Metasploit

Metasploit WordPress

What is Metasploit?

Metasploit for Windows

Metasploit Linux

Armitage Metasploit

Termux Metasploit

Rapid7 Penetration Testing

Nmap Penetration Testing

Linux Penetration Testing

Salesforce Penetration Testing

Kubernetes Pentesting

IoT Penetration Testing

SAP Penetration Testing

Docker Pentest

Pentera Pentesting

Infrastructure Penetration Testing

Cobalt Pentest

CREST Penetration Testing

CompTIA Pentest+ Certification

Azure Penetration Testing

AWS Penetration Testing

Firebase Pentest

External Pen Testing

Hardware Penetration Testing

Android Pentesting

HTML Injection

Code Injection

Blind SQL Injection

HTTP Header Injection

LDAP Injection

PHP Injection

Command Injection

NoSQL Injection

Authentication Methods

Brute Force Attack

What is Fuzzing and How Does It Work?

What is API Fuzzing?

What is Fuzzer?

White Box Fuzzing

Related tests

JWT authentication bypass via jku header injection

eSMTP - Config Discovery

Nginx - Git Configuration Exposure

Laravel - Sensitive Information Disclosure

Docker Container - Misconfiguration Exposure

Msmtp - Config Exposure

Parameters.yml - File Discovery

Mongo Express - Unauthenticated Access

Apache Airflow Configuration Exposure

Dockerrun AWS Configuration Exposure

Apache Config file disclosure

Appspec Yml Disclosure

Explore more from Akto

Blog

Be updated about everything related to API Security, new API vulnerabilities, industry news and product updates.

Test Library

Discover and find tests from Akto's 100+ API Security test library. Choose your template or add a new template to start your API Security testing.

Try now

Documentation

Check out Akto's product documentation for all information related to features and how to use them.

See docs