CVE-2022-31898 in GL-MT300N-V2 Mango
Summary
by MITRE • 10/28/2022
gl-inet GL-MT300N-V2 Mango v3.212 and GL-AX1800 Flint v3.214 were discovered to contain multiple command injection vulnerabilities via the ping_addr and trace_addr function parameters.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 05/07/2025
The vulnerability identified as CVE-2022-31898 affects gl-inet routers including the GL-MT300N-V2 Mango version 3.212 and GL-AX1800 Flint version 3.214, representing a critical command injection flaw that compromises the security of these network devices. This vulnerability stems from improper input validation within the web interface of these routers, specifically targeting the ping_addr and trace_addr function parameters that are used for network diagnostic operations. The affected devices are commonly deployed in residential and small office environments, making them attractive targets for attackers seeking to gain unauthorized access to network infrastructure.
The technical implementation of this vulnerability resides in the way the router firmware processes user-supplied input for network diagnostic commands. When users enter addresses for ping or trace operations through the web interface, the system fails to properly sanitize or escape the input parameters before passing them to underlying system commands. This lack of input validation creates an environment where malicious actors can inject arbitrary commands that execute with the privileges of the web server process, typically running with administrative privileges on the device. The vulnerability maps directly to CWE-77 which defines command injection as the execution of arbitrary commands through untrusted input, and aligns with ATT&CK technique T1059.001 for command and scripting interpreter.
The operational impact of this vulnerability extends beyond simple unauthorized access, as it provides attackers with a potential foothold for further network exploitation. An attacker who successfully exploits this vulnerability could execute arbitrary code on the affected devices, potentially leading to complete device compromise, data exfiltration, or use of the compromised device as a pivot point for attacking other systems within the local network. The vulnerability affects both the GL-MT300N-V2 and GL-AX1800 models, indicating a widespread issue within the gl-inet product line that requires immediate attention. Network administrators should be particularly concerned about the potential for persistent backdoors to be installed, as the command injection could be used to modify system files or install malicious firmware components.
Mitigation strategies for CVE-2022-31898 should include immediate firmware updates from gl-inet to address the identified command injection flaws, as well as network segmentation to limit the potential impact of successful exploitation. Organizations should implement network monitoring to detect unusual outbound traffic patterns that might indicate command execution, and consider disabling unnecessary diagnostic functions if they are not required for network operations. The vulnerability demonstrates the critical importance of input validation in web applications and highlights the need for proper security testing of embedded network devices. Security teams should also consider implementing intrusion detection systems specifically designed to identify command injection attempts in network infrastructure devices, as these attacks often follow predictable patterns that can be detected through behavioral analysis.