GL.iNet AX1800 vulnerabilities

A command injection vulnerability was identified in GL.iNet AX1800 up to 4.8.3 in the remove_rule function of /usr/share/gl-ngx/oui-rpc.lua (RPC Endpoint component). Manipulation of the args.id argument allows remote command execution. The exploit is publicly available.

In GL.iNet AX1800 versions 4.6.4 and 4.6.8, the opkg-call script at /usr/libexec/opkg-call is executed with root privileges when triggered via the LuCI web interface or authenticated API calls for package management. The vulnerable code uses shell redirection to create a lock file in the world-writable /tmp directory.

The LuCI web interface on GL.Inet AX1800 Version 4.6.4 & 4.6.8 is vulnerable. It lacks rate limiting or account lockout mechanisms on the authentication endpoint (/cgi-bin/luci), allowing an unauthenticated attacker on the local network to perform unlimited password attempts against the admin interface. Fix available in version 4.8.2.