Privilege Escalation via Shell Redirection in GL.iNet AX1800 Opkg Script

Executive Summary

This vulnerability exists in GL.iNet AX1800 versions 4.6.4 and 4.6.8 within a custom opkg wrapper script located at /usr/libexec/opkg-call. The script runs with root privileges when triggered via the LuCI web interface or authenticated API calls to manage packages. The vulnerable code uses shell redirection to create a lock file in the world-writable /tmp directory, which can be exploited.

Useful 0 Not Useful 0

Impact Analysis

Because the vulnerable script runs with root privileges and uses a world-writable directory for lock file creation, an attacker could potentially exploit this to escalate privileges or interfere with package management, leading to unauthorized actions or compromise of the device.

Useful 0 Not Useful 0