Search
Find a vulnerability
Search criteria
20 vulnerabilities by GL-iNet
CVE-2026-18616 (GCVE-0-2026-18616)
Vulnerability from cvelistv5 – Published: 2026-08-03 18:30 – Updated: 2026-08-04 17:13
VLAI
EPSS
VEX
Title
GL-iNet GL-MT3000 wg-server.so Native Plugin glc server.set_peer command injection
Summary
A vulnerability was identified in GL-iNet GL-MT3000 up to 4.4.5. The impacted element is the function server.set_peer of the file /cgi-bin/glc of the component wg-server.so Native Plugin. The manipulation of the argument public_key leads to command injection. Remote exploitation of the attack is possible. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure and confirmed the existence of the vulnerability.
Severity
9.8 (Critical)
9.8 (Critical)
SSVC
Exploitation: poc
Automatable: yes
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-04 17:13 UTC
Assigner
References
5 references
| URL | Tags |
|---|---|
| https://vuldb.com/vuln/385536 | vdb-entrytechnical-description |
| https://vuldb.com/vuln/385536/cti | signaturepermissions-required |
| https://vuldb.com/cve/CVE-2026-18616 | third-party-advisory |
| https://vuldb.com/submit/851580 | third-party-advisory |
| https://github.com/StrTzz123/iot_vul/blob/main/GL… | exploit |
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-18616",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-04T17:13:15.374457Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-04T17:13:28.400Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:o:gl-inet:gl-mt3000_firmware:*:*:*:*:*:*:*:*"
],
"modules": [
"wg-server.so Native Plugin"
],
"product": "GL-MT3000",
"vendor": "GL-iNet",
"versions": [
{
"status": "affected",
"version": "4.4.0"
},
{
"status": "affected",
"version": "4.4.1"
},
{
"status": "affected",
"version": "4.4.2"
},
{
"status": "affected",
"version": "4.4.3"
},
{
"status": "affected",
"version": "4.4.4"
},
{
"status": "affected",
"version": "4.4.5"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "Strforexc2 (VulDB User)"
},
{
"lang": "en",
"type": "coordinator",
"value": "VulDB CNA Team"
}
],
"descriptions": [
{
"lang": "en",
"value": "A vulnerability was identified in GL-iNet GL-MT3000 up to 4.4.5. The impacted element is the function server.set_peer of the file /cgi-bin/glc of the component wg-server.so Native Plugin. The manipulation of the argument public_key leads to command injection. Remote exploitation of the attack is possible. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure and confirmed the existence of the vulnerability."
}
],
"metrics": [
{
"cvssV4_0": {
"baseScore": 9.3,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P",
"version": "4.0"
}
},
{
"cvssV3_1": {
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P/RL:X/RC:R",
"version": "3.1"
}
},
{
"cvssV3_0": {
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P/RL:X/RC:R",
"version": "3.0"
}
},
{
"cvssV2_0": {
"baseScore": 10,
"vectorString": "AV:N/AC:L/Au:N/C:C/I:C/A:C/E:POC/RL:ND/RC:C",
"version": "2.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-77",
"description": "Command Injection",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-74",
"description": "Injection",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-03T18:30:10.794Z",
"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"shortName": "VulDB"
},
"references": [
{
"name": "VDB-385536 | GL-iNet GL-MT3000 wg-server.so Native Plugin glc server.set_peer command injection",
"tags": [
"vdb-entry",
"technical-description"
],
"url": "https://vuldb.com/vuln/385536"
},
{
"name": "VDB-385536 | CTI Indicators (IOB, IOC, TTP, IOA)",
"tags": [
"signature",
"permissions-required"
],
"url": "https://vuldb.com/vuln/385536/cti"
},
{
"name": "CVE-2026-18616 | CVE Analysis and Report",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/cve/CVE-2026-18616"
},
{
"name": "Submit #851580 | GL-iNet MT3000 4.4.5 Command Injection",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/submit/851580"
},
{
"tags": [
"exploit"
],
"url": "https://github.com/StrTzz123/iot_vul/blob/main/GL-iNet/MT3000/4.4.5/wg_set_peer_rce/CVE.md"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-08-03T00:00:00.000Z",
"value": "Advisory disclosed"
},
{
"lang": "en",
"time": "2026-08-03T02:00:00.000Z",
"value": "VulDB entry created"
},
{
"lang": "en",
"time": "2026-08-03T09:38:58.000Z",
"value": "VulDB entry last update"
}
],
"title": "GL-iNet GL-MT3000 wg-server.so Native Plugin glc server.set_peer command injection",
"x_generator": [
"VulDB PVTS v202608"
]
}
},
"cveMetadata": {
"assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"assignerShortName": "VulDB",
"cveId": "CVE-2026-18616",
"datePublished": "2026-08-03T18:30:10.794Z",
"dateReserved": "2026-08-03T07:33:34.035Z",
"dateUpdated": "2026-08-04T17:13:28.400Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-18615 (GCVE-0-2026-18615)
Vulnerability from cvelistv5 – Published: 2026-08-03 18:15 – Updated: 2026-08-03 20:17
VLAI
EPSS
VEX
Title
GL-iNet GL-MT3000 wg-server.so Native Plugin glc wg-server.generate_publickey command injection
Summary
A vulnerability was determined in GL-iNet GL-MT3000 up to 4.4.5. The affected element is the function wg-server.generate_publickey of the file /cgi-bin/glc of the component wg-server.so Native Plugin. Executing a manipulation of the argument private_key can lead to command injection. The attack may be launched remotely. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure and confirmed the existence of the vulnerability.
Severity
9.8 (Critical)
9.8 (Critical)
SSVC
Exploitation: poc
Automatable: yes
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-03 20:17 UTC
Assigner
References
5 references
| URL | Tags |
|---|---|
| https://vuldb.com/vuln/385535 | vdb-entrytechnical-description |
| https://vuldb.com/vuln/385535/cti | signaturepermissions-required |
| https://vuldb.com/cve/CVE-2026-18615 | third-party-advisory |
| https://vuldb.com/submit/851566 | third-party-advisory |
| https://github.com/StrTzz123/iot_vul/blob/main/GL… | exploit |
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-18615",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-03T20:17:41.463508Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-03T20:17:48.811Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:o:gl-inet:gl-mt3000_firmware:*:*:*:*:*:*:*:*"
],
"modules": [
"wg-server.so Native Plugin"
],
"product": "GL-MT3000",
"vendor": "GL-iNet",
"versions": [
{
"status": "affected",
"version": "4.4.0"
},
{
"status": "affected",
"version": "4.4.1"
},
{
"status": "affected",
"version": "4.4.2"
},
{
"status": "affected",
"version": "4.4.3"
},
{
"status": "affected",
"version": "4.4.4"
},
{
"status": "affected",
"version": "4.4.5"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "Strforexc2 (VulDB User)"
},
{
"lang": "en",
"type": "coordinator",
"value": "VulDB CNA Team"
}
],
"descriptions": [
{
"lang": "en",
"value": "A vulnerability was determined in GL-iNet GL-MT3000 up to 4.4.5. The affected element is the function wg-server.generate_publickey of the file /cgi-bin/glc of the component wg-server.so Native Plugin. Executing a manipulation of the argument private_key can lead to command injection. The attack may be launched remotely. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure and confirmed the existence of the vulnerability."
}
],
"metrics": [
{
"cvssV4_0": {
"baseScore": 9.3,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P",
"version": "4.0"
}
},
{
"cvssV3_1": {
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P/RL:X/RC:R",
"version": "3.1"
}
},
{
"cvssV3_0": {
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P/RL:X/RC:R",
"version": "3.0"
}
},
{
"cvssV2_0": {
"baseScore": 10,
"vectorString": "AV:N/AC:L/Au:N/C:C/I:C/A:C/E:POC/RL:ND/RC:C",
"version": "2.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-77",
"description": "Command Injection",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-74",
"description": "Injection",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-03T18:15:08.392Z",
"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"shortName": "VulDB"
},
"references": [
{
"name": "VDB-385535 | GL-iNet GL-MT3000 wg-server.so Native Plugin glc wg-server.generate_publickey command injection",
"tags": [
"vdb-entry",
"technical-description"
],
"url": "https://vuldb.com/vuln/385535"
},
{
"name": "VDB-385535 | CTI Indicators (IOB, IOC, TTP, IOA)",
"tags": [
"signature",
"permissions-required"
],
"url": "https://vuldb.com/vuln/385535/cti"
},
{
"name": "CVE-2026-18615 | CVE Analysis and Report",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/cve/CVE-2026-18615"
},
{
"name": "Submit #851566 | GL-iNet GL-MT3000 4.4.5 Command Injection",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/submit/851566"
},
{
"tags": [
"exploit"
],
"url": "https://github.com/StrTzz123/iot_vul/blob/main/GL-iNet/MT3000/4.4.5/wg_generate_publickey_glc/CVE.md"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-08-03T00:00:00.000Z",
"value": "Advisory disclosed"
},
{
"lang": "en",
"time": "2026-08-03T02:00:00.000Z",
"value": "VulDB entry created"
},
{
"lang": "en",
"time": "2026-08-03T09:38:54.000Z",
"value": "VulDB entry last update"
}
],
"title": "GL-iNet GL-MT3000 wg-server.so Native Plugin glc wg-server.generate_publickey command injection",
"x_generator": [
"VulDB PVTS v202608"
]
}
},
"cveMetadata": {
"assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"assignerShortName": "VulDB",
"cveId": "CVE-2026-18615",
"datePublished": "2026-08-03T18:15:08.392Z",
"dateReserved": "2026-08-03T07:33:29.637Z",
"dateUpdated": "2026-08-03T20:17:48.811Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-18614 (GCVE-0-2026-18614)
Vulnerability from cvelistv5 – Published: 2026-08-03 18:00 – Updated: 2026-08-03 18:53
VLAI
EPSS
VEX
Title
GL-iNet GL-MT3000 s2s.so Native Plugin glc s2s.enable_echo_server command injection
Summary
A vulnerability was found in GL-iNet GL-MT3000 up to 4.4.5. Impacted is the function s2s.enable_echo_server of the file /cgi-bin/glc of the component s2s.so Native Plugin. Performing a manipulation of the argument port results in command injection. The attack may be initiated remotely. The exploit has been made public and could be used. The vendor was contacted early about this disclosure and confirmed the existence of the vulnerability.
Severity
9.8 (Critical)
9.8 (Critical)
SSVC
Exploitation: poc
Automatable: yes
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-03 18:53 UTC
Assigner
References
5 references
| URL | Tags |
|---|---|
| https://vuldb.com/vuln/385534 | vdb-entrytechnical-description |
| https://vuldb.com/vuln/385534/cti | signaturepermissions-required |
| https://vuldb.com/cve/CVE-2026-18614 | third-party-advisory |
| https://vuldb.com/submit/851558 | third-party-advisory |
| https://github.com/StrTzz123/iot_vul/blob/main/GL… | exploit |
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-18614",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-03T18:53:37.892034Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-03T18:53:45.564Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:o:gl-inet:gl-mt3000_firmware:*:*:*:*:*:*:*:*"
],
"modules": [
"s2s.so Native Plugin"
],
"product": "GL-MT3000",
"vendor": "GL-iNet",
"versions": [
{
"status": "affected",
"version": "4.4.0"
},
{
"status": "affected",
"version": "4.4.1"
},
{
"status": "affected",
"version": "4.4.2"
},
{
"status": "affected",
"version": "4.4.3"
},
{
"status": "affected",
"version": "4.4.4"
},
{
"status": "affected",
"version": "4.4.5"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "strforexc (VulDB User)"
},
{
"lang": "en",
"type": "coordinator",
"value": "VulDB CNA Team"
}
],
"descriptions": [
{
"lang": "en",
"value": "A vulnerability was found in GL-iNet GL-MT3000 up to 4.4.5. Impacted is the function s2s.enable_echo_server of the file /cgi-bin/glc of the component s2s.so Native Plugin. Performing a manipulation of the argument port results in command injection. The attack may be initiated remotely. The exploit has been made public and could be used. The vendor was contacted early about this disclosure and confirmed the existence of the vulnerability."
}
],
"metrics": [
{
"cvssV4_0": {
"baseScore": 9.3,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P",
"version": "4.0"
}
},
{
"cvssV3_1": {
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P/RL:X/RC:R",
"version": "3.1"
}
},
{
"cvssV3_0": {
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P/RL:X/RC:R",
"version": "3.0"
}
},
{
"cvssV2_0": {
"baseScore": 10,
"vectorString": "AV:N/AC:L/Au:N/C:C/I:C/A:C/E:POC/RL:ND/RC:C",
"version": "2.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-77",
"description": "Command Injection",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-74",
"description": "Injection",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-03T18:00:09.989Z",
"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"shortName": "VulDB"
},
"references": [
{
"name": "VDB-385534 | GL-iNet GL-MT3000 s2s.so Native Plugin glc s2s.enable_echo_server command injection",
"tags": [
"vdb-entry",
"technical-description"
],
"url": "https://vuldb.com/vuln/385534"
},
{
"name": "VDB-385534 | CTI Indicators (IOB, IOC, TTP, IOA)",
"tags": [
"signature",
"permissions-required"
],
"url": "https://vuldb.com/vuln/385534/cti"
},
{
"name": "CVE-2026-18614 | CVE Analysis and Report",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/cve/CVE-2026-18614"
},
{
"name": "Submit #851558 | GL-iNet GL-MT3000 4.4.5 Command Injection",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/submit/851558"
},
{
"tags": [
"exploit"
],
"url": "https://github.com/StrTzz123/iot_vul/blob/main/GL-iNet/MT3000/4.4.5/s2s_enable_echo_server_glc_rce/CVE.md"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-08-03T00:00:00.000Z",
"value": "Advisory disclosed"
},
{
"lang": "en",
"time": "2026-08-03T02:00:00.000Z",
"value": "VulDB entry created"
},
{
"lang": "en",
"time": "2026-08-03T09:38:49.000Z",
"value": "VulDB entry last update"
}
],
"title": "GL-iNet GL-MT3000 s2s.so Native Plugin glc s2s.enable_echo_server command injection",
"x_generator": [
"VulDB PVTS v202608"
]
}
},
"cveMetadata": {
"assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"assignerShortName": "VulDB",
"cveId": "CVE-2026-18614",
"datePublished": "2026-08-03T18:00:09.989Z",
"dateReserved": "2026-08-03T07:33:25.401Z",
"dateUpdated": "2026-08-03T18:53:45.564Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-18613 (GCVE-0-2026-18613)
Vulnerability from cvelistv5 – Published: 2026-08-03 17:45 – Updated: 2026-08-03 21:19
VLAI
EPSS
VEX
Title
GL-iNet GL-MT3000 plugins.so Native Plugin glc plugins.set_config injection
Summary
A vulnerability has been found in GL-iNet GL-MT3000 up to 4.4.5. This issue affects the function plugins.set_config of the file /cgi-bin/glc of the component plugins.so Native Plugin. Such manipulation leads to injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure and confirmed the existence of the vulnerability.
Severity
9.8 (Critical)
9.8 (Critical)
SSVC
Exploitation: poc
Automatable: yes
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-03 21:16 UTC
Assigner
References
5 references
| URL | Tags |
|---|---|
| https://vuldb.com/vuln/385533 | vdb-entrytechnical-description |
| https://vuldb.com/vuln/385533/cti | signaturepermissions-required |
| https://vuldb.com/cve/CVE-2026-18613 | third-party-advisory |
| https://vuldb.com/submit/851557 | third-party-advisory |
| https://github.com/StrTzz123/iot_vul/blob/main/GL… | exploit |
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-18613",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-03T21:16:38.795979Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-03T21:19:17.133Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:o:gl-inet:gl-mt3000_firmware:*:*:*:*:*:*:*:*"
],
"modules": [
"plugins.so Native Plugin"
],
"product": "GL-MT3000",
"vendor": "GL-iNet",
"versions": [
{
"status": "affected",
"version": "4.4.0"
},
{
"status": "affected",
"version": "4.4.1"
},
{
"status": "affected",
"version": "4.4.2"
},
{
"status": "affected",
"version": "4.4.3"
},
{
"status": "affected",
"version": "4.4.4"
},
{
"status": "affected",
"version": "4.4.5"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "strforexc (VulDB User)"
},
{
"lang": "en",
"type": "coordinator",
"value": "VulDB CNA Team"
}
],
"descriptions": [
{
"lang": "en",
"value": "A vulnerability has been found in GL-iNet GL-MT3000 up to 4.4.5. This issue affects the function plugins.set_config of the file /cgi-bin/glc of the component plugins.so Native Plugin. Such manipulation leads to injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure and confirmed the existence of the vulnerability."
}
],
"metrics": [
{
"cvssV4_0": {
"baseScore": 9.3,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P",
"version": "4.0"
}
},
{
"cvssV3_1": {
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P/RL:X/RC:R",
"version": "3.1"
}
},
{
"cvssV3_0": {
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P/RL:X/RC:R",
"version": "3.0"
}
},
{
"cvssV2_0": {
"baseScore": 10,
"vectorString": "AV:N/AC:L/Au:N/C:C/I:C/A:C/E:POC/RL:ND/RC:C",
"version": "2.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-74",
"description": "Injection",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-707",
"description": "Improper Neutralization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-03T17:45:09.762Z",
"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"shortName": "VulDB"
},
"references": [
{
"name": "VDB-385533 | GL-iNet GL-MT3000 plugins.so Native Plugin glc plugins.set_config injection",
"tags": [
"vdb-entry",
"technical-description"
],
"url": "https://vuldb.com/vuln/385533"
},
{
"name": "VDB-385533 | CTI Indicators (IOB, IOC, TTP, IOA)",
"tags": [
"signature",
"permissions-required"
],
"url": "https://vuldb.com/vuln/385533/cti"
},
{
"name": "CVE-2026-18613 | CVE Analysis and Report",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/cve/CVE-2026-18613"
},
{
"name": "Submit #851557 | GL-iNet MT3000 4.4.5 Feed Hijacking",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/submit/851557"
},
{
"tags": [
"exploit"
],
"url": "https://github.com/StrTzz123/iot_vul/blob/main/GL-iNet/MT3000/4.4.5/plugins_set_config_glc_write/CVE.md"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-08-03T00:00:00.000Z",
"value": "Advisory disclosed"
},
{
"lang": "en",
"time": "2026-08-03T02:00:00.000Z",
"value": "VulDB entry created"
},
{
"lang": "en",
"time": "2026-08-03T09:38:45.000Z",
"value": "VulDB entry last update"
}
],
"title": "GL-iNet GL-MT3000 plugins.so Native Plugin glc plugins.set_config injection",
"x_generator": [
"VulDB PVTS v202608"
]
}
},
"cveMetadata": {
"assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"assignerShortName": "VulDB",
"cveId": "CVE-2026-18613",
"datePublished": "2026-08-03T17:45:09.762Z",
"dateReserved": "2026-08-03T07:33:21.492Z",
"dateUpdated": "2026-08-03T21:19:17.133Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-18612 (GCVE-0-2026-18612)
Vulnerability from cvelistv5 – Published: 2026-08-03 17:30 – Updated: 2026-08-03 20:13
VLAI
EPSS
VEX
Title
GL-iNet GL-MT3000 plugins.so Native Plugin glc plugins.install_package command injection
Summary
A flaw has been found in GL-iNet GL-MT3000 up to 4.4.5. This vulnerability affects the function plugins.remove_package/plugins.install_package of the file /cgi-bin/glc of the component plugins.so Native Plugin. This manipulation causes command injection. The attack can be initiated remotely. The exploit has been published and may be used. The vendor was contacted early about this disclosure and confirmed the existence of the vulnerability.
Severity
9.8 (Critical)
9.8 (Critical)
SSVC
Exploitation: poc
Automatable: yes
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-03 20:13 UTC
Assigner
References
8 references
| URL | Tags |
|---|---|
| https://vuldb.com/vuln/385532 | vdb-entrytechnical-description |
| https://vuldb.com/vuln/385532/cti | signaturepermissions-required |
| https://vuldb.com/cve/CVE-2026-18612 | third-party-advisory |
| https://vuldb.com/submit/851553 | third-party-advisory |
| https://vuldb.com/submit/851596 | third-party-advisory |
| https://vuldb.com/submit/851597 | third-party-advisory |
| https://vuldb.com/submit/851600 | third-party-advisory |
| https://github.com/StrTzz123/iot_vul/blob/main/GL… | exploit |
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-18612",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-03T20:13:18.854600Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-03T20:13:29.372Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:o:gl-inet:gl-mt3000_firmware:*:*:*:*:*:*:*:*"
],
"modules": [
"plugins.so Native Plugin"
],
"product": "GL-MT3000",
"vendor": "GL-iNet",
"versions": [
{
"status": "affected",
"version": "4.4.0"
},
{
"status": "affected",
"version": "4.4.1"
},
{
"status": "affected",
"version": "4.4.2"
},
{
"status": "affected",
"version": "4.4.3"
},
{
"status": "affected",
"version": "4.4.4"
},
{
"status": "affected",
"version": "4.4.5"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "strforexc (VulDB User)"
},
{
"lang": "en",
"type": "coordinator",
"value": "VulDB CNA Team"
}
],
"descriptions": [
{
"lang": "en",
"value": "A flaw has been found in GL-iNet GL-MT3000 up to 4.4.5. This vulnerability affects the function plugins.remove_package/plugins.install_package of the file /cgi-bin/glc of the component plugins.so Native Plugin. This manipulation causes command injection. The attack can be initiated remotely. The exploit has been published and may be used. The vendor was contacted early about this disclosure and confirmed the existence of the vulnerability."
}
],
"metrics": [
{
"cvssV4_0": {
"baseScore": 9.3,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P",
"version": "4.0"
}
},
{
"cvssV3_1": {
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P/RL:X/RC:R",
"version": "3.1"
}
},
{
"cvssV3_0": {
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P/RL:X/RC:R",
"version": "3.0"
}
},
{
"cvssV2_0": {
"baseScore": 10,
"vectorString": "AV:N/AC:L/Au:N/C:C/I:C/A:C/E:POC/RL:ND/RC:C",
"version": "2.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-77",
"description": "Command Injection",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-74",
"description": "Injection",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-03T17:30:09.869Z",
"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"shortName": "VulDB"
},
"references": [
{
"name": "VDB-385532 | GL-iNet GL-MT3000 plugins.so Native Plugin glc plugins.install_package command injection",
"tags": [
"vdb-entry",
"technical-description"
],
"url": "https://vuldb.com/vuln/385532"
},
{
"name": "VDB-385532 | CTI Indicators (IOB, IOC, TTP, IOA)",
"tags": [
"signature",
"permissions-required"
],
"url": "https://vuldb.com/vuln/385532/cti"
},
{
"name": "CVE-2026-18612 | CVE Analysis and Report",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/cve/CVE-2026-18612"
},
{
"name": "Submit #851553 | GL-iNet MT3000 4.4.5 Command Injection",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/submit/851553"
},
{
"name": "Submit #851596 | GL.iNet GL-MT3000 4.4.5 Command Injection (Duplicate)",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/submit/851596"
},
{
"name": "Submit #851597 | GL.iNet GL-MT3000 4.4.5 Command Injection (Duplicate)",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/submit/851597"
},
{
"name": "Submit #851600 | GL.iNet GL-MT3000 4.4.5 Command Injection (Duplicate)",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/submit/851600"
},
{
"tags": [
"exploit"
],
"url": "https://github.com/StrTzz123/iot_vul/blob/main/GL-iNet/MT3000/4.4.5/plugins_package_name_glc_rce/CVE.md"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-08-03T00:00:00.000Z",
"value": "Advisory disclosed"
},
{
"lang": "en",
"time": "2026-08-03T02:00:00.000Z",
"value": "VulDB entry created"
},
{
"lang": "en",
"time": "2026-08-03T09:38:41.000Z",
"value": "VulDB entry last update"
}
],
"title": "GL-iNet GL-MT3000 plugins.so Native Plugin glc plugins.install_package command injection",
"x_generator": [
"VulDB PVTS v202608"
]
}
},
"cveMetadata": {
"assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"assignerShortName": "VulDB",
"cveId": "CVE-2026-18612",
"datePublished": "2026-08-03T17:30:09.869Z",
"dateReserved": "2026-08-03T07:33:17.223Z",
"dateUpdated": "2026-08-03T20:13:29.372Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-32293 (GCVE-0-2026-32293)
Vulnerability from cvelistv5 – Published: 2026-03-17 17:19 – Updated: 2026-03-23 19:34
VLAI
EPSS
VEX
Title
GL-iNet Comet (GL-RM1) KVM insufficient certificate validation
Summary
The GL-iNet Comet (GL-RM1) KVM connects to a GL-iNet site during boot-up to provision client and CA certificates. The GL-RM1 does not verify certificates used for this connection, allowing an attacker-in-the-middle to serve invalid client and CA certificates. The GL-RM1 will attempt to use the invalid certificates and fail to connect to the legitimate GL-iNet KVM cloud service.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · cisa-cg (v2.0.3)
Decision recorded 2026-03-10 18:41 UTC
CWE
- CWE-295 - Improper Certificate Validation
References
Impacted products
Date Public
2026-03-17 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-32293",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-03-17T17:57:13.718072Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-03-17T17:57:19.156Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unknown",
"product": "Comet KVM",
"vendor": "GL-iNet",
"versions": [
{
"lessThan": "1.7.2",
"status": "affected",
"version": "0",
"versionType": "custom"
},
{
"status": "unaffected",
"version": "1.7.2"
}
]
}
],
"credits": [
{
"lang": "en",
"value": "Reynaldo Vasquez Garcia, Eclypsium"
}
],
"datePublic": "2026-03-17T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "The GL-iNet Comet (GL-RM1) KVM connects to a GL-iNet site during boot-up to provision client and CA certificates. The GL-RM1 does not verify certificates used for this connection, allowing an attacker-in-the-middle to serve invalid client and CA certificates. The GL-RM1 will attempt to use the invalid certificates and fail to connect to the legitimate GL-iNet KVM cloud service."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 3.7,
"baseSeverity": "LOW",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L",
"version": "3.1"
}
},
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "PRESENT",
"attackVector": "NETWORK",
"baseScore": 6.3,
"baseSeverity": "MEDIUM",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "LOW",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "NONE"
}
},
{
"other": {
"content": {
"id": "CVE-2026-32293",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-03-10T18:41:00.293658Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-295",
"description": "CWE-295 Improper Certificate Validation",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-03-23T19:34:57.871Z",
"orgId": "9119a7d8-5eab-497f-8521-727c672e3725",
"shortName": "cisa-cg"
},
"references": [
{
"name": "url",
"url": "https://eclypsium.com/blog/your-kvm-is-the-weak-link-how-30-dollar-devices-can-own-your-entire-network/"
},
{
"name": "url",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-32293"
},
{
"name": "url",
"url": "https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/IT/white/2025/va-26-076-01.json"
},
{
"name": "url",
"tags": [
"patch"
],
"url": "https://dl.gl-inet.com/release/kvm/release/RM1/1.7.2"
}
],
"title": "GL-iNet Comet (GL-RM1) KVM insufficient certificate validation"
}
},
"cveMetadata": {
"assignerOrgId": "9119a7d8-5eab-497f-8521-727c672e3725",
"assignerShortName": "cisa-cg",
"cveId": "CVE-2026-32293",
"datePublished": "2026-03-17T17:19:07.549Z",
"dateReserved": "2026-03-11T18:26:24.845Z",
"dateUpdated": "2026-03-23T19:34:57.871Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-32292 (GCVE-0-2026-32292)
Vulnerability from cvelistv5 – Published: 2026-03-17 17:18 – Updated: 2026-03-23 19:34
VLAI
EPSS
VEX
Title
GL-iNet Comet (GL-RM1) KVM insufficient login rate-limiting
Summary
The GL-iNet Comet (GL-RM1) KVM web interface does not limit login requests, enabling brute-force attempts to guess credentials.
Severity
7.5 (High)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: total
CISA Coordinator · cisa-cg (v2.0.3)
Decision recorded 2026-03-13 18:47 UTC
CWE
- CWE-307 - Improper Restriction of Excessive Authentication Attempts
References
Impacted products
Date Public
2026-03-17 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-32292",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-03-17T17:56:24.256642Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-03-17T17:56:30.651Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unknown",
"product": "Comet KVM",
"vendor": "GL-iNet",
"versions": [
{
"lessThan": "1.7.2",
"status": "affected",
"version": "0",
"versionType": "custom"
},
{
"status": "unaffected",
"version": "1.7.2"
}
]
}
],
"credits": [
{
"lang": "en",
"value": "Reynaldo Vasquez Garcia, Eclypsium"
}
],
"datePublic": "2026-03-17T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "The GL-iNet Comet (GL-RM1) KVM web interface does not limit login requests, enabling brute-force attempts to guess credentials."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 9.3,
"baseSeverity": "CRITICAL",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "HIGH",
"subConfidentialityImpact": "HIGH",
"subIntegrityImpact": "HIGH",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:H/SI:H/SA:H",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "NONE"
}
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2026-32292",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-03-13T18:47:55.255705Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-307",
"description": "CWE-307 Improper Restriction of Excessive Authentication Attempts",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-03-23T19:34:33.902Z",
"orgId": "9119a7d8-5eab-497f-8521-727c672e3725",
"shortName": "cisa-cg"
},
"references": [
{
"name": "url",
"url": "https://eclypsium.com/blog/your-kvm-is-the-weak-link-how-30-dollar-devices-can-own-your-entire-network/"
},
{
"name": "url",
"url": "https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/IT/white/2025/va-26-076-01.json"
},
{
"name": "url",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-32292"
},
{
"name": "url",
"tags": [
"patch"
],
"url": "https://dl.gl-inet.com/release/kvm/release/RM1/1.7.2"
}
],
"title": "GL-iNet Comet (GL-RM1) KVM insufficient login rate-limiting"
}
},
"cveMetadata": {
"assignerOrgId": "9119a7d8-5eab-497f-8521-727c672e3725",
"assignerShortName": "cisa-cg",
"cveId": "CVE-2026-32292",
"datePublished": "2026-03-17T17:18:54.851Z",
"dateReserved": "2026-03-11T18:26:16.060Z",
"dateUpdated": "2026-03-23T19:34:33.902Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-32291 (GCVE-0-2026-32291)
Vulnerability from cvelistv5 – Published: 2026-03-17 17:18 – Updated: 2026-03-23 19:34
VLAI
EPSS
VEX
Title
GL-iNet Comet (GL-RM1) KVM unauthenticated root access via UART serial console
Summary
The GL-iNet Comet (GL-RM1) KVM before 1.8.2 does not require authentication on the UART serial console. This attack requires physically opening the device and connecting to the UART pins.
Severity
SSVC
Exploitation: poc
Automatable: no
Technical Impact: total
CISA Coordinator · cisa-cg (v2.0.3)
Decision recorded 2026-03-10 17:28 UTC
CWE
- CWE-306 - Missing Authentication for Critical Function
References
Impacted products
Date Public
2026-03-17 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-32291",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-03-17T18:12:47.629054Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-03-17T18:12:50.187Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unknown",
"product": "Comet KVM",
"vendor": "GL-iNet",
"versions": [
{
"lessThan": "1.8.2",
"status": "affected",
"version": "0",
"versionType": "custom"
},
{
"status": "unaffected",
"version": "1.8.2"
}
]
}
],
"credits": [
{
"lang": "en",
"value": "Reynaldo Vasquez Garcia, Eclypsium"
}
],
"datePublic": "2026-03-17T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "The GL-iNet Comet (GL-RM1) KVM before 1.8.2 does not require authentication on the UART serial console. This attack requires physically opening the device and connecting to the UART pins."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "PHYSICAL",
"baseScore": 7,
"baseSeverity": "HIGH",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH"
}
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "PHYSICAL",
"availabilityImpact": "HIGH",
"baseScore": 6.8,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2026-32291",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-03-10T17:28:38.117871Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-306",
"description": "CWE-306 Missing Authentication for Critical Function",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-03-23T19:34:20.347Z",
"orgId": "9119a7d8-5eab-497f-8521-727c672e3725",
"shortName": "cisa-cg"
},
"references": [
{
"name": "url",
"url": "https://eclypsium.com/blog/your-kvm-is-the-weak-link-how-30-dollar-devices-can-own-your-entire-network/"
},
{
"name": "url",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-32291"
},
{
"name": "url",
"url": "https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/IT/white/2025/va-26-076-01.json"
},
{
"name": "url",
"tags": [
"patch"
],
"url": "https://dl.gl-inet.com/release/kvm/release/RM1/1.8.2"
}
],
"title": "GL-iNet Comet (GL-RM1) KVM unauthenticated root access via UART serial console"
}
},
"cveMetadata": {
"assignerOrgId": "9119a7d8-5eab-497f-8521-727c672e3725",
"assignerShortName": "cisa-cg",
"cveId": "CVE-2026-32291",
"datePublished": "2026-03-17T17:18:34.947Z",
"dateReserved": "2026-03-11T18:26:10.038Z",
"dateUpdated": "2026-03-23T19:34:20.347Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-32290 (GCVE-0-2026-32290)
Vulnerability from cvelistv5 – Published: 2026-03-17 17:18 – Updated: 2026-03-23 19:34
VLAI
EPSS
VEX
Title
GL-iNet Comet (GL-RM1) KVM insufficient firmware verification
Summary
The GL-iNet Comet (GL-RM1) KVM before version 1.8.2 does not sufficiently verify the authenticity of uploaded firmware files. An attacker-in-the-middle or a compromised update server could modify the firmware and the corresponding MD5 hash to pass verification.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · cisa-cg (v2.0.3)
Decision recorded 2026-03-13 18:19 UTC
CWE
- CWE-345 - Insufficient Verification of Data Authenticity
References
Impacted products
Date Public
2026-03-17 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-32290",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-03-17T17:54:42.384230Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-03-17T17:54:48.338Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unknown",
"product": "Comet KVM",
"vendor": "GL-iNet",
"versions": [
{
"lessThan": "1.8.2",
"status": "affected",
"version": "0",
"versionType": "custom"
},
{
"status": "unaffected",
"version": "1.8.2"
}
]
}
],
"credits": [
{
"lang": "en",
"value": "Reynaldo Vasquez Garcia, Eclypsium"
}
],
"datePublic": "2026-03-17T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "The GL-iNet Comet (GL-RM1) KVM before version 1.8.2 does not sufficiently verify the authenticity of uploaded firmware files. An attacker-in-the-middle or a compromised update server could modify the firmware and the corresponding MD5 hash to pass verification."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "PRESENT",
"attackVector": "LOCAL",
"baseScore": 7,
"baseSeverity": "HIGH",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "HIGH",
"subConfidentialityImpact": "HIGH",
"subIntegrityImpact": "HIGH",
"userInteraction": "ACTIVE",
"vectorString": "CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:A/VC:N/VI:H/VA:N/SC:H/SI:H/SA:H",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "HIGH"
}
},
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "LOCAL",
"availabilityImpact": "NONE",
"baseScore": 4.7,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:N",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2026-32290",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-03-13T18:19:33.819737Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-345",
"description": "CWE-345 Insufficient Verification of Data Authenticity",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-03-23T19:34:09.794Z",
"orgId": "9119a7d8-5eab-497f-8521-727c672e3725",
"shortName": "cisa-cg"
},
"references": [
{
"name": "url",
"url": "https://eclypsium.com/blog/your-kvm-is-the-weak-link-how-30-dollar-devices-can-own-your-entire-network/"
},
{
"name": "url",
"url": "https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/IT/white/2025/va-26-076-01.json"
},
{
"name": "url",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-32290"
},
{
"name": "url",
"tags": [
"patch"
],
"url": "https://dl.gl-inet.com/release/kvm/release/RM1/1.8.2"
}
],
"title": "GL-iNet Comet (GL-RM1) KVM insufficient firmware verification"
}
},
"cveMetadata": {
"assignerOrgId": "9119a7d8-5eab-497f-8521-727c672e3725",
"assignerShortName": "cisa-cg",
"cveId": "CVE-2026-32290",
"datePublished": "2026-03-17T17:18:14.150Z",
"dateReserved": "2026-03-11T18:26:03.157Z",
"dateUpdated": "2026-03-23T19:34:09.794Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2025-44018 (GCVE-0-2025-44018)
Vulnerability from cvelistv5 – Published: 2025-11-24 15:11 – Updated: 2025-11-24 17:03
VLAI
EPSS
VEX
Summary
A firmware downgrade vulnerability exists in the OTA Update functionality of GL-Inet GL-AXT1800 4.7.0. A specially crafted .tar file can lead to a firmware downgrade. An attacker can perform a man-in-the-middle attack to trigger this vulnerability.
Severity
8.3 (High)
SSVC
Exploitation: poc
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2025-11-24 15:48 UTC
CWE
- CWE-295 - Improper Certificate Validation
Assigner
References
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| GL-Inet | GL-AXT1800 |
Affected:
4.7.0
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2025-44018",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-11-24T15:48:47.598635Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2025-11-24T15:49:17.269Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
},
{
"providerMetadata": {
"dateUpdated": "2025-11-24T17:03:28.621Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"url": "https://www.talosintelligence.com/vulnerability_reports/TALOS-2025-2230"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "GL-AXT1800",
"vendor": "GL-Inet",
"versions": [
{
"status": "affected",
"version": "4.7.0"
}
]
}
],
"credits": [
{
"lang": "en",
"value": "Discovered by Lilith \u0026gt;_\u0026gt; of Cisco Talos."
}
],
"descriptions": [
{
"lang": "en",
"value": "A firmware downgrade vulnerability exists in the OTA Update functionality of GL-Inet GL-AXT1800 4.7.0. A specially crafted .tar file can lead to a firmware downgrade. An attacker can perform a man-in-the-middle attack to trigger this vulnerability."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.3,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-295",
"description": "CWE-295: Improper Certificate Validation",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-11-24T15:11:02.641Z",
"orgId": "b86d76f8-0f8a-4a96-a78d-d8abfc7fc29b",
"shortName": "talos"
},
"references": [
{
"name": "https://talosintelligence.com/vulnerability_reports/TALOS-2025-2230",
"url": "https://talosintelligence.com/vulnerability_reports/TALOS-2025-2230"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "b86d76f8-0f8a-4a96-a78d-d8abfc7fc29b",
"assignerShortName": "talos",
"cveId": "CVE-2025-44018",
"datePublished": "2025-11-24T15:11:02.641Z",
"dateReserved": "2025-07-21T21:26:26.309Z",
"dateUpdated": "2025-11-24T17:03:28.621Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2024-45259 (GCVE-0-2024-45259)
Vulnerability from cvelistv5 – Published: 2024-10-24 00:00 – Updated: 2024-10-28 19:38
VLAI
EPSS
VEX
Summary
An issue was discovered on certain GL-iNet devices, including MT6000, MT3000, MT2500, AXT1800, and AX1800 4.6.2. By intercepting an HTTP request and changing the filename property in the download interface, any file on the device can be deleted.
Severity
6.5 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2024-10-28 19:31 UTC
CWE
- n/a
- CWE-326 - Inadequate Encryption Strength
Assigner
References
1 reference
Impacted products
6 products
| Vendor | Product | Version | |
|---|---|---|---|
| gl-inet | gl-b3000_firmware |
Affected:
4.5.18 , < 4.5.19
(custom)
cpe:2.3:o:gl-inet:gl-b3000_firmware:*:*:*:*:*:*:*:* |
|
| gl-inet | gl-mt6000_firmware |
Affected:
4.6.2 , < 4.6.4
(custom)
cpe:2.3:o:gl-inet:gl-ax1800_firmware:*:*:*:*:*:*:*:* cpe:2.3:o:gl-inet:gl-axt1800_firmware:-:*:*:*:*:*:*:* cpe:2.3:o:gl-inet:gl-mt2500_firmware:-:*:*:*:*:*:*:* cpe:2.3:o:gl-inet:gl-mt3000_firmware:-:*:*:*:*:*:*:* cpe:2.3:o:gl-inet:gl-mt6000_firmware:*:*:*:*:*:*:*:* |
|
| gl-inet | gl-x300b_firmware |
Affected:
4.5.17 , < 4.5.18
(custom)
cpe:2.3:o:gl-inet:gl-a1300_firmware:-:*:*:*:*:*:*:* cpe:2.3:o:gl-inet:gl-x300b_firmware:-:*:*:*:*:*:*:* |
|
| gl-inet | gl-xe300_firmware |
Affected:
4.4.9 , < 4.4.10
(custom)
cpe:2.3:o:gl-inet:gl-x3000_firmware:-:*:*:*:*:*:*:* cpe:2.3:o:gl-inet:gl-xe300_firmware:-:*:*:*:*:*:*:* |
|
| gl-inet | gl-x750_firmware |
Affected:
4.3.18 , < 4.3.19
(custom)
cpe:2.3:o:gl-inet:gl-mt1300_firmware:-:*:*:*:*:*:*:* cpe:2.3:o:gl-inet:gl-sft1200_firmware:-:*:*:*:*:*:*:* cpe:2.3:o:gl-inet:gl-x750_firmware:-:*:*:*:*:*:*:* |
|
| gl-inet | gl-xe300_firmware |
Affected:
4.3.17 , < 4.3.18
(custom)
cpe:2.3:o:gl-inet:gl-ar300m16_firmware:*:*:*:*:*:*:*:* cpe:2.3:o:gl-inet:gl-ar750_firmware:-:*:*:*:*:*:*:* cpe:2.3:o:gl-inet:gl-ar300m_firmware:-:*:*:*:*:*:*:* cpe:2.3:o:gl-inet:gl-ar750s_firmware:-:*:*:*:*:*:*:* cpe:2.3:o:gl-inet:gl-b1300_firmware:-:*:*:*:*:*:*:* cpe:2.3:o:gl-inet:gl-e750_firmware:-:*:*:*:*:*:*:* cpe:2.3:o:gl-inet:gl-mt300n-v2_firmware:-:*:*:*:*:*:*:* cpe:2.3:o:gl-inet:gl-xe300_firmware:-:*:*:*:*:*:*:* |
{
"containers": {
"adp": [
{
"affected": [
{
"cpes": [
"cpe:2.3:o:gl-inet:gl-b3000_firmware:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "gl-b3000_firmware",
"vendor": "gl-inet",
"versions": [
{
"lessThan": "4.5.19",
"status": "affected",
"version": "4.5.18",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:o:gl-inet:gl-ax1800_firmware:*:*:*:*:*:*:*:*",
"cpe:2.3:o:gl-inet:gl-axt1800_firmware:-:*:*:*:*:*:*:*",
"cpe:2.3:o:gl-inet:gl-mt2500_firmware:-:*:*:*:*:*:*:*",
"cpe:2.3:o:gl-inet:gl-mt3000_firmware:-:*:*:*:*:*:*:*",
"cpe:2.3:o:gl-inet:gl-mt6000_firmware:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "gl-mt6000_firmware",
"vendor": "gl-inet",
"versions": [
{
"lessThan": "4.6.4",
"status": "affected",
"version": "4.6.2",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:o:gl-inet:gl-a1300_firmware:-:*:*:*:*:*:*:*",
"cpe:2.3:o:gl-inet:gl-x300b_firmware:-:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "gl-x300b_firmware",
"vendor": "gl-inet",
"versions": [
{
"lessThan": "4.5.18",
"status": "affected",
"version": "4.5.17",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:o:gl-inet:gl-x3000_firmware:-:*:*:*:*:*:*:*",
"cpe:2.3:o:gl-inet:gl-xe300_firmware:-:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "gl-xe300_firmware",
"vendor": "gl-inet",
"versions": [
{
"lessThan": "4.4.10",
"status": "affected",
"version": "4.4.9",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:o:gl-inet:gl-mt1300_firmware:-:*:*:*:*:*:*:*",
"cpe:2.3:o:gl-inet:gl-sft1200_firmware:-:*:*:*:*:*:*:*",
"cpe:2.3:o:gl-inet:gl-x750_firmware:-:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "gl-x750_firmware",
"vendor": "gl-inet",
"versions": [
{
"lessThan": "4.3.19",
"status": "affected",
"version": "4.3.18",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:o:gl-inet:gl-ar300m16_firmware:*:*:*:*:*:*:*:*",
"cpe:2.3:o:gl-inet:gl-ar750_firmware:-:*:*:*:*:*:*:*",
"cpe:2.3:o:gl-inet:gl-ar300m_firmware:-:*:*:*:*:*:*:*",
"cpe:2.3:o:gl-inet:gl-ar750s_firmware:-:*:*:*:*:*:*:*",
"cpe:2.3:o:gl-inet:gl-b1300_firmware:-:*:*:*:*:*:*:*",
"cpe:2.3:o:gl-inet:gl-e750_firmware:-:*:*:*:*:*:*:*",
"cpe:2.3:o:gl-inet:gl-mt300n-v2_firmware:-:*:*:*:*:*:*:*",
"cpe:2.3:o:gl-inet:gl-xe300_firmware:-:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "gl-xe300_firmware",
"vendor": "gl-inet",
"versions": [
{
"lessThan": "4.3.18",
"status": "affected",
"version": "4.3.17",
"versionType": "custom"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "ADJACENT_NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2024-45259",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-10-28T19:31:51.013958Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-326",
"description": "CWE-326 Inadequate Encryption Strength",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-10-28T19:38:53.728Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "An issue was discovered on certain GL-iNet devices, including MT6000, MT3000, MT2500, AXT1800, and AX1800 4.6.2. By intercepting an HTTP request and changing the filename property in the download interface, any file on the device can be deleted."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-10-24T20:09:41.653Z",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"url": "https://github.com/gl-inet/CVE-issues/blob/main/4.0.0/Delete%20Any%20File%20via%20Download%20Interface.md"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2024-45259",
"datePublished": "2024-10-24T00:00:00.000Z",
"dateReserved": "2024-08-25T00:00:00.000Z",
"dateUpdated": "2024-10-28T19:38:53.728Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2024-45262 (GCVE-0-2024-45262)
Vulnerability from cvelistv5 – Published: 2024-10-24 00:00 – Updated: 2024-10-28 19:22
VLAI
EPSS
VEX
Summary
An issue was discovered on certain GL-iNet devices, including MT6000, MT3000, MT2500, AXT1800, and AX1800 4.6.2. The params parameter in the call method of the /rpc endpoint is vulnerable to arbitrary directory traversal, which enables attackers to execute scripts under any path.
Severity
8.8 (High)
SSVC
Exploitation: poc
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2024-10-28 19:21 UTC
CWE
- n/a
- CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Assigner
References
1 reference
Impacted products
6 products
| Vendor | Product | Version | |
|---|---|---|---|
| gl-inet | gl-b3000_firmware |
Affected:
4.5.18 , < 4.5.19
(custom)
cpe:2.3:o:gl-inet:gl-b3000_firmware:*:*:*:*:*:*:*:* |
|
| gl-inet | gl-mt6000_firmware |
Affected:
4.6.2 , < 4.6.4
(custom)
cpe:2.3:o:gl-inet:gl-ax1800_firmware:*:*:*:*:*:*:*:* cpe:2.3:o:gl-inet:gl-axt1800_firmware:-:*:*:*:*:*:*:* cpe:2.3:o:gl-inet:gl-mt2500_firmware:-:*:*:*:*:*:*:* cpe:2.3:o:gl-inet:gl-mt3000_firmware:-:*:*:*:*:*:*:* cpe:2.3:o:gl-inet:gl-mt6000_firmware:*:*:*:*:*:*:*:* |
|
| gl-inet | gl-x300b_firmware |
Affected:
4.5.17 , < 4.5.18
(custom)
cpe:2.3:o:gl-inet:gl-a1300_firmware:-:*:*:*:*:*:*:* cpe:2.3:o:gl-inet:gl-x300b_firmware:-:*:*:*:*:*:*:* |
|
| gl-inet | gl-xe300_firmware |
Affected:
4.4.9 , < 4.4.10
(custom)
cpe:2.3:o:gl-inet:gl-x3000_firmware:-:*:*:*:*:*:*:* cpe:2.3:o:gl-inet:gl-xe300_firmware:-:*:*:*:*:*:*:* |
|
| gl-inet | gl-x750_firmware |
Affected:
4.3.18 , < 4.3.19
(custom)
cpe:2.3:o:gl-inet:gl-mt1300_firmware:-:*:*:*:*:*:*:* cpe:2.3:o:gl-inet:gl-sft1200_firmware:-:*:*:*:*:*:*:* cpe:2.3:o:gl-inet:gl-x750_firmware:-:*:*:*:*:*:*:* |
|
| gl-inet | gl-xe300_firmware |
Affected:
4.3.17 , < 4.3.18
(custom)
cpe:2.3:o:gl-inet:gl-ar300m16_firmware:*:*:*:*:*:*:*:* cpe:2.3:o:gl-inet:gl-ar750_firmware:-:*:*:*:*:*:*:* cpe:2.3:o:gl-inet:gl-ar300m_firmware:-:*:*:*:*:*:*:* cpe:2.3:o:gl-inet:gl-ar750s_firmware:-:*:*:*:*:*:*:* cpe:2.3:o:gl-inet:gl-b1300_firmware:-:*:*:*:*:*:*:* cpe:2.3:o:gl-inet:gl-e750_firmware:-:*:*:*:*:*:*:* cpe:2.3:o:gl-inet:gl-mt300n-v2_firmware:-:*:*:*:*:*:*:* cpe:2.3:o:gl-inet:gl-xe300_firmware:-:*:*:*:*:*:*:* |
{
"containers": {
"adp": [
{
"affected": [
{
"cpes": [
"cpe:2.3:o:gl-inet:gl-b3000_firmware:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "gl-b3000_firmware",
"vendor": "gl-inet",
"versions": [
{
"lessThan": "4.5.19",
"status": "affected",
"version": "4.5.18",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:o:gl-inet:gl-ax1800_firmware:*:*:*:*:*:*:*:*",
"cpe:2.3:o:gl-inet:gl-axt1800_firmware:-:*:*:*:*:*:*:*",
"cpe:2.3:o:gl-inet:gl-mt2500_firmware:-:*:*:*:*:*:*:*",
"cpe:2.3:o:gl-inet:gl-mt3000_firmware:-:*:*:*:*:*:*:*",
"cpe:2.3:o:gl-inet:gl-mt6000_firmware:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "gl-mt6000_firmware",
"vendor": "gl-inet",
"versions": [
{
"lessThan": "4.6.4",
"status": "affected",
"version": "4.6.2",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:o:gl-inet:gl-a1300_firmware:-:*:*:*:*:*:*:*",
"cpe:2.3:o:gl-inet:gl-x300b_firmware:-:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "gl-x300b_firmware",
"vendor": "gl-inet",
"versions": [
{
"lessThan": "4.5.18",
"status": "affected",
"version": "4.5.17",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:o:gl-inet:gl-x3000_firmware:-:*:*:*:*:*:*:*",
"cpe:2.3:o:gl-inet:gl-xe300_firmware:-:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "gl-xe300_firmware",
"vendor": "gl-inet",
"versions": [
{
"lessThan": "4.4.10",
"status": "affected",
"version": "4.4.9",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:o:gl-inet:gl-mt1300_firmware:-:*:*:*:*:*:*:*",
"cpe:2.3:o:gl-inet:gl-sft1200_firmware:-:*:*:*:*:*:*:*",
"cpe:2.3:o:gl-inet:gl-x750_firmware:-:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "gl-x750_firmware",
"vendor": "gl-inet",
"versions": [
{
"lessThan": "4.3.19",
"status": "affected",
"version": "4.3.18",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:o:gl-inet:gl-ar300m16_firmware:*:*:*:*:*:*:*:*",
"cpe:2.3:o:gl-inet:gl-ar750_firmware:-:*:*:*:*:*:*:*",
"cpe:2.3:o:gl-inet:gl-ar300m_firmware:-:*:*:*:*:*:*:*",
"cpe:2.3:o:gl-inet:gl-ar750s_firmware:-:*:*:*:*:*:*:*",
"cpe:2.3:o:gl-inet:gl-b1300_firmware:-:*:*:*:*:*:*:*",
"cpe:2.3:o:gl-inet:gl-e750_firmware:-:*:*:*:*:*:*:*",
"cpe:2.3:o:gl-inet:gl-mt300n-v2_firmware:-:*:*:*:*:*:*:*",
"cpe:2.3:o:gl-inet:gl-xe300_firmware:-:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "gl-xe300_firmware",
"vendor": "gl-inet",
"versions": [
{
"lessThan": "4.3.18",
"status": "affected",
"version": "4.3.17",
"versionType": "custom"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "ADJACENT_NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2024-45262",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-10-28T19:21:47.832625Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-22",
"description": "CWE-22 Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-10-28T19:22:25.505Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "An issue was discovered on certain GL-iNet devices, including MT6000, MT3000, MT2500, AXT1800, and AX1800 4.6.2. The params parameter in the call method of the /rpc endpoint is vulnerable to arbitrary directory traversal, which enables attackers to execute scripts under any path."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-10-24T20:19:54.001Z",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"url": "https://github.com/gl-inet/CVE-issues/blob/main/4.0.0/Improper%20Pathname%20Restriction%20Leading%20to%20Path%20Traversal%20in%20Restricted%20Directories.md"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2024-45262",
"datePublished": "2024-10-24T00:00:00.000Z",
"dateReserved": "2024-08-25T00:00:00.000Z",
"dateUpdated": "2024-10-28T19:22:25.505Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2024-45263 (GCVE-0-2024-45263)
Vulnerability from cvelistv5 – Published: 2024-10-24 00:00 – Updated: 2024-10-28 18:52
VLAI
EPSS
VEX
Summary
An issue was discovered on certain GL-iNet devices, including MT6000, MT3000, MT2500, AXT1800, and AX1800 4.6.2. The upload interface allows the uploading of arbitrary files to the device. Once the device executes the files, it can lead to information leakage, enabling complete control.
Severity
8.8 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2024-10-28 18:34 UTC
CWE
- n/a
- CWE-434 - Unrestricted Upload of File with Dangerous Type
Assigner
References
1 reference
Impacted products
6 products
| Vendor | Product | Version | |
|---|---|---|---|
| gl-inet | gl-b3000_firmware |
Affected:
4.5.18 , < 4.5.19
(custom)
cpe:2.3:o:gl-inet:gl-b3000_firmware:*:*:*:*:*:*:*:* |
|
| gl-inet | gl-mt6000_firmware |
Affected:
4.6.2 , < 4.6.4
(custom)
cpe:2.3:o:gl-inet:gl-ax1800_firmware:*:*:*:*:*:*:*:* cpe:2.3:o:gl-inet:gl-axt1800_firmware:-:*:*:*:*:*:*:* cpe:2.3:o:gl-inet:gl-mt2500_firmware:-:*:*:*:*:*:*:* cpe:2.3:o:gl-inet:gl-mt3000_firmware:-:*:*:*:*:*:*:* cpe:2.3:o:gl-inet:gl-mt6000_firmware:*:*:*:*:*:*:*:* |
|
| gl-inet | gl-x300b_firmware |
Affected:
4.5.17 , < 4.5.18
(custom)
cpe:2.3:o:gl-inet:gl-a1300_firmware:-:*:*:*:*:*:*:* cpe:2.3:o:gl-inet:gl-x300b_firmware:-:*:*:*:*:*:*:* |
|
| gl-inet | gl-xe300_firmware |
Affected:
4.4.9 , < 4.4.10
(custom)
cpe:2.3:o:gl-inet:gl-x3000_firmware:-:*:*:*:*:*:*:* cpe:2.3:o:gl-inet:gl-xe300_firmware:-:*:*:*:*:*:*:* |
|
| gl-inet | gl-x750_firmware |
Affected:
4.3.18 , < 4.3.19
(custom)
cpe:2.3:o:gl-inet:gl-mt1300_firmware:-:*:*:*:*:*:*:* cpe:2.3:o:gl-inet:gl-sft1200_firmware:-:*:*:*:*:*:*:* cpe:2.3:o:gl-inet:gl-x750_firmware:-:*:*:*:*:*:*:* |
|
| gl-inet | gl-xe300_firmware |
Affected:
4.3.17 , < 4.3.18
(custom)
cpe:2.3:o:gl-inet:gl-ar300m16_firmware:*:*:*:*:*:*:*:* cpe:2.3:o:gl-inet:gl-ar750_firmware:-:*:*:*:*:*:*:* cpe:2.3:o:gl-inet:gl-ar300m_firmware:-:*:*:*:*:*:*:* cpe:2.3:o:gl-inet:gl-ar750s_firmware:-:*:*:*:*:*:*:* cpe:2.3:o:gl-inet:gl-b1300_firmware:-:*:*:*:*:*:*:* cpe:2.3:o:gl-inet:gl-e750_firmware:-:*:*:*:*:*:*:* cpe:2.3:o:gl-inet:gl-mt300n-v2_firmware:-:*:*:*:*:*:*:* cpe:2.3:o:gl-inet:gl-xe300_firmware:-:*:*:*:*:*:*:* |
{
"containers": {
"adp": [
{
"affected": [
{
"cpes": [
"cpe:2.3:o:gl-inet:gl-b3000_firmware:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "gl-b3000_firmware",
"vendor": "gl-inet",
"versions": [
{
"lessThan": "4.5.19",
"status": "affected",
"version": "4.5.18",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:o:gl-inet:gl-ax1800_firmware:*:*:*:*:*:*:*:*",
"cpe:2.3:o:gl-inet:gl-axt1800_firmware:-:*:*:*:*:*:*:*",
"cpe:2.3:o:gl-inet:gl-mt2500_firmware:-:*:*:*:*:*:*:*",
"cpe:2.3:o:gl-inet:gl-mt3000_firmware:-:*:*:*:*:*:*:*",
"cpe:2.3:o:gl-inet:gl-mt6000_firmware:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "gl-mt6000_firmware",
"vendor": "gl-inet",
"versions": [
{
"lessThan": "4.6.4",
"status": "affected",
"version": "4.6.2",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:o:gl-inet:gl-a1300_firmware:-:*:*:*:*:*:*:*",
"cpe:2.3:o:gl-inet:gl-x300b_firmware:-:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "gl-x300b_firmware",
"vendor": "gl-inet",
"versions": [
{
"lessThan": "4.5.18",
"status": "affected",
"version": "4.5.17",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:o:gl-inet:gl-x3000_firmware:-:*:*:*:*:*:*:*",
"cpe:2.3:o:gl-inet:gl-xe300_firmware:-:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "gl-xe300_firmware",
"vendor": "gl-inet",
"versions": [
{
"lessThan": "4.4.10",
"status": "affected",
"version": "4.4.9",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:o:gl-inet:gl-mt1300_firmware:-:*:*:*:*:*:*:*",
"cpe:2.3:o:gl-inet:gl-sft1200_firmware:-:*:*:*:*:*:*:*",
"cpe:2.3:o:gl-inet:gl-x750_firmware:-:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "gl-x750_firmware",
"vendor": "gl-inet",
"versions": [
{
"lessThan": "4.3.19",
"status": "affected",
"version": "4.3.18",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:o:gl-inet:gl-ar300m16_firmware:*:*:*:*:*:*:*:*",
"cpe:2.3:o:gl-inet:gl-ar750_firmware:-:*:*:*:*:*:*:*",
"cpe:2.3:o:gl-inet:gl-ar300m_firmware:-:*:*:*:*:*:*:*",
"cpe:2.3:o:gl-inet:gl-ar750s_firmware:-:*:*:*:*:*:*:*",
"cpe:2.3:o:gl-inet:gl-b1300_firmware:-:*:*:*:*:*:*:*",
"cpe:2.3:o:gl-inet:gl-e750_firmware:-:*:*:*:*:*:*:*",
"cpe:2.3:o:gl-inet:gl-mt300n-v2_firmware:-:*:*:*:*:*:*:*",
"cpe:2.3:o:gl-inet:gl-xe300_firmware:-:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "gl-xe300_firmware",
"vendor": "gl-inet",
"versions": [
{
"lessThan": "4.3.18",
"status": "affected",
"version": "4.3.17",
"versionType": "custom"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "ADJACENT_NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2024-45263",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-10-28T18:34:32.730872Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-434",
"description": "CWE-434 Unrestricted Upload of File with Dangerous Type",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-10-28T18:52:30.245Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "An issue was discovered on certain GL-iNet devices, including MT6000, MT3000, MT2500, AXT1800, and AX1800 4.6.2. The upload interface allows the uploading of arbitrary files to the device. Once the device executes the files, it can lead to information leakage, enabling complete control."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-10-24T20:21:28.712Z",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"url": "https://github.com/gl-inet/CVE-issues/blob/main/4.0.0/Arbitrary%20File%20Upload%20to%20ovpn_upload%20via%20Upload%20Interface.md"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2024-45263",
"datePublished": "2024-10-24T00:00:00.000Z",
"dateReserved": "2024-08-25T00:00:00.000Z",
"dateUpdated": "2024-10-28T18:52:30.245Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2024-45260 (GCVE-0-2024-45260)
Vulnerability from cvelistv5 – Published: 2024-10-24 00:00 – Updated: 2024-10-28 19:27
VLAI
EPSS
VEX
Summary
An issue was discovered on certain GL-iNet devices, including MT6000, MT3000, MT2500, AXT1800, and AX1800 4.6.2. Users who belong to unauthorized groups can invoke any interface of the device, thereby gaining complete control over it.
Severity
SSVC
Exploitation: poc
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2024-10-28 19:24 UTC
CWE
- n/a
- CWE-863 - Incorrect Authorization
Assigner
References
1 reference
Impacted products
6 products
| Vendor | Product | Version | |
|---|---|---|---|
| gl-inet | gl-b3000_firmware |
Affected:
4.5.18 , < 4.5.19
(custom)
cpe:2.3:o:gl-inet:gl-b3000_firmware:*:*:*:*:*:*:*:* |
|
| gl-inet | gl-mt6000_firmware |
Affected:
4.6.2 , < 4.6.4
(custom)
cpe:2.3:o:gl-inet:gl-ax1800_firmware:*:*:*:*:*:*:*:* cpe:2.3:o:gl-inet:gl-axt1800_firmware:-:*:*:*:*:*:*:* cpe:2.3:o:gl-inet:gl-mt2500_firmware:-:*:*:*:*:*:*:* cpe:2.3:o:gl-inet:gl-mt3000_firmware:-:*:*:*:*:*:*:* cpe:2.3:o:gl-inet:gl-mt6000_firmware:*:*:*:*:*:*:*:* |
|
| gl-inet | gl-x300b_firmware |
Affected:
4.5.17 , < 4.5.18
(custom)
cpe:2.3:o:gl-inet:gl-a1300_firmware:-:*:*:*:*:*:*:* cpe:2.3:o:gl-inet:gl-x300b_firmware:-:*:*:*:*:*:*:* |
|
| gl-inet | gl-xe300_firmware |
Affected:
4.4.9 , < 4.4.10
(custom)
cpe:2.3:o:gl-inet:gl-x3000_firmware:-:*:*:*:*:*:*:* cpe:2.3:o:gl-inet:gl-xe300_firmware:-:*:*:*:*:*:*:* |
|
| gl-inet | gl-x750_firmware |
Affected:
4.3.18 , < 4.3.19
(custom)
cpe:2.3:o:gl-inet:gl-mt1300_firmware:-:*:*:*:*:*:*:* cpe:2.3:o:gl-inet:gl-sft1200_firmware:-:*:*:*:*:*:*:* cpe:2.3:o:gl-inet:gl-x750_firmware:-:*:*:*:*:*:*:* |
|
| gl-inet | gl-xe300_firmware |
Affected:
4.3.17 , < 4.3.18
(custom)
cpe:2.3:o:gl-inet:gl-ar300m16_firmware:*:*:*:*:*:*:*:* cpe:2.3:o:gl-inet:gl-ar750_firmware:-:*:*:*:*:*:*:* cpe:2.3:o:gl-inet:gl-ar300m_firmware:-:*:*:*:*:*:*:* cpe:2.3:o:gl-inet:gl-ar750s_firmware:-:*:*:*:*:*:*:* cpe:2.3:o:gl-inet:gl-b1300_firmware:-:*:*:*:*:*:*:* cpe:2.3:o:gl-inet:gl-e750_firmware:-:*:*:*:*:*:*:* cpe:2.3:o:gl-inet:gl-mt300n-v2_firmware:-:*:*:*:*:*:*:* cpe:2.3:o:gl-inet:gl-xe300_firmware:-:*:*:*:*:*:*:* |
{
"containers": {
"adp": [
{
"affected": [
{
"cpes": [
"cpe:2.3:o:gl-inet:gl-b3000_firmware:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "gl-b3000_firmware",
"vendor": "gl-inet",
"versions": [
{
"lessThan": "4.5.19",
"status": "affected",
"version": "4.5.18",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:o:gl-inet:gl-ax1800_firmware:*:*:*:*:*:*:*:*",
"cpe:2.3:o:gl-inet:gl-axt1800_firmware:-:*:*:*:*:*:*:*",
"cpe:2.3:o:gl-inet:gl-mt2500_firmware:-:*:*:*:*:*:*:*",
"cpe:2.3:o:gl-inet:gl-mt3000_firmware:-:*:*:*:*:*:*:*",
"cpe:2.3:o:gl-inet:gl-mt6000_firmware:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "gl-mt6000_firmware",
"vendor": "gl-inet",
"versions": [
{
"lessThan": "4.6.4",
"status": "affected",
"version": "4.6.2",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:o:gl-inet:gl-a1300_firmware:-:*:*:*:*:*:*:*",
"cpe:2.3:o:gl-inet:gl-x300b_firmware:-:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "gl-x300b_firmware",
"vendor": "gl-inet",
"versions": [
{
"lessThan": "4.5.18",
"status": "affected",
"version": "4.5.17",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:o:gl-inet:gl-x3000_firmware:-:*:*:*:*:*:*:*",
"cpe:2.3:o:gl-inet:gl-xe300_firmware:-:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "gl-xe300_firmware",
"vendor": "gl-inet",
"versions": [
{
"lessThan": "4.4.10",
"status": "affected",
"version": "4.4.9",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:o:gl-inet:gl-mt1300_firmware:-:*:*:*:*:*:*:*",
"cpe:2.3:o:gl-inet:gl-sft1200_firmware:-:*:*:*:*:*:*:*",
"cpe:2.3:o:gl-inet:gl-x750_firmware:-:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "gl-x750_firmware",
"vendor": "gl-inet",
"versions": [
{
"lessThan": "4.3.19",
"status": "affected",
"version": "4.3.18",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:o:gl-inet:gl-ar300m16_firmware:*:*:*:*:*:*:*:*",
"cpe:2.3:o:gl-inet:gl-ar750_firmware:-:*:*:*:*:*:*:*",
"cpe:2.3:o:gl-inet:gl-ar300m_firmware:-:*:*:*:*:*:*:*",
"cpe:2.3:o:gl-inet:gl-ar750s_firmware:-:*:*:*:*:*:*:*",
"cpe:2.3:o:gl-inet:gl-b1300_firmware:-:*:*:*:*:*:*:*",
"cpe:2.3:o:gl-inet:gl-e750_firmware:-:*:*:*:*:*:*:*",
"cpe:2.3:o:gl-inet:gl-mt300n-v2_firmware:-:*:*:*:*:*:*:*",
"cpe:2.3:o:gl-inet:gl-xe300_firmware:-:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "gl-xe300_firmware",
"vendor": "gl-inet",
"versions": [
{
"lessThan": "4.3.18",
"status": "affected",
"version": "4.3.17",
"versionType": "custom"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "ADJACENT_NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2024-45260",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-10-28T19:24:33.863289Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-863",
"description": "CWE-863 Incorrect Authorization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-10-28T19:27:01.398Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "An issue was discovered on certain GL-iNet devices, including MT6000, MT3000, MT2500, AXT1800, and AX1800 4.6.2. Users who belong to unauthorized groups can invoke any interface of the device, thereby gaining complete control over it."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-10-24T20:11:10.715Z",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"url": "https://github.com/gl-inet/CVE-issues/blob/main/4.0.0/Unauthorized%20Access%20to%20File%20Download%20and%20Upload%20Interfaces.md"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2024-45260",
"datePublished": "2024-10-24T00:00:00.000Z",
"dateReserved": "2024-08-25T00:00:00.000Z",
"dateUpdated": "2024-10-28T19:27:01.398Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2024-45261 (GCVE-0-2024-45261)
Vulnerability from cvelistv5 – Published: 2024-10-24 00:00 – Updated: 2024-10-28 19:19
VLAI
EPSS
VEX
Summary
An issue was discovered on certain GL-iNet devices, including MT6000, MT3000, MT2500, AXT1800, and AX1800 4.6.2. The SID generated for a specific user is not tied to that user itself, which allows other users to potentially use it for authentication. Once an attacker bypasses the application's authentication procedures, they can generate a valid SID, escalate privileges, and gain full control.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2024-10-28 19:12 UTC
CWE
- n/a
- CWE-863 - Incorrect Authorization
Assigner
References
1 reference
Impacted products
6 products
| Vendor | Product | Version | |
|---|---|---|---|
| gl-inet | gl-b3000_firmware |
Affected:
4.5.18 , < 4.5.19
(custom)
cpe:2.3:o:gl-inet:gl-b3000_firmware:*:*:*:*:*:*:*:* |
|
| gl-inet | gl-mt6000_firmware |
Affected:
4.6.2 , < 4.6.4
(custom)
cpe:2.3:o:gl-inet:gl-ax1800_firmware:*:*:*:*:*:*:*:* cpe:2.3:o:gl-inet:gl-axt1800_firmware:-:*:*:*:*:*:*:* cpe:2.3:o:gl-inet:gl-mt2500_firmware:-:*:*:*:*:*:*:* cpe:2.3:o:gl-inet:gl-mt3000_firmware:-:*:*:*:*:*:*:* cpe:2.3:o:gl-inet:gl-mt6000_firmware:*:*:*:*:*:*:*:* |
|
| gl-inet | gl-x300b_firmware |
Affected:
4.5.17 , < 4.5.18
(custom)
cpe:2.3:o:gl-inet:gl-a1300_firmware:-:*:*:*:*:*:*:* cpe:2.3:o:gl-inet:gl-x300b_firmware:-:*:*:*:*:*:*:* |
|
| gl-inet | gl-xe300_firmware |
Affected:
4.4.9 , < 4.4.10
(custom)
cpe:2.3:o:gl-inet:gl-x3000_firmware:-:*:*:*:*:*:*:* cpe:2.3:o:gl-inet:gl-xe300_firmware:-:*:*:*:*:*:*:* |
|
| gl-inet | gl-x750_firmware |
Affected:
4.3.18 , < 4.3.19
(custom)
cpe:2.3:o:gl-inet:gl-mt1300_firmware:-:*:*:*:*:*:*:* cpe:2.3:o:gl-inet:gl-sft1200_firmware:-:*:*:*:*:*:*:* cpe:2.3:o:gl-inet:gl-x750_firmware:-:*:*:*:*:*:*:* |
|
| gl-inet | gl-xe300_firmware |
Affected:
4.3.17 , < 4.3.18
(custom)
cpe:2.3:o:gl-inet:gl-ar300m16_firmware:*:*:*:*:*:*:*:* cpe:2.3:o:gl-inet:gl-ar750_firmware:-:*:*:*:*:*:*:* cpe:2.3:o:gl-inet:gl-ar300m_firmware:-:*:*:*:*:*:*:* cpe:2.3:o:gl-inet:gl-ar750s_firmware:-:*:*:*:*:*:*:* cpe:2.3:o:gl-inet:gl-b1300_firmware:-:*:*:*:*:*:*:* cpe:2.3:o:gl-inet:gl-e750_firmware:-:*:*:*:*:*:*:* cpe:2.3:o:gl-inet:gl-mt300n-v2_firmware:-:*:*:*:*:*:*:* cpe:2.3:o:gl-inet:gl-xe300_firmware:-:*:*:*:*:*:*:* |
{
"containers": {
"adp": [
{
"affected": [
{
"cpes": [
"cpe:2.3:o:gl-inet:gl-b3000_firmware:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "gl-b3000_firmware",
"vendor": "gl-inet",
"versions": [
{
"lessThan": "4.5.19",
"status": "affected",
"version": "4.5.18",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:o:gl-inet:gl-ax1800_firmware:*:*:*:*:*:*:*:*",
"cpe:2.3:o:gl-inet:gl-axt1800_firmware:-:*:*:*:*:*:*:*",
"cpe:2.3:o:gl-inet:gl-mt2500_firmware:-:*:*:*:*:*:*:*",
"cpe:2.3:o:gl-inet:gl-mt3000_firmware:-:*:*:*:*:*:*:*",
"cpe:2.3:o:gl-inet:gl-mt6000_firmware:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "gl-mt6000_firmware",
"vendor": "gl-inet",
"versions": [
{
"lessThan": "4.6.4",
"status": "affected",
"version": "4.6.2",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:o:gl-inet:gl-a1300_firmware:-:*:*:*:*:*:*:*",
"cpe:2.3:o:gl-inet:gl-x300b_firmware:-:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "gl-x300b_firmware",
"vendor": "gl-inet",
"versions": [
{
"lessThan": "4.5.18",
"status": "affected",
"version": "4.5.17",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:o:gl-inet:gl-x3000_firmware:-:*:*:*:*:*:*:*",
"cpe:2.3:o:gl-inet:gl-xe300_firmware:-:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "gl-xe300_firmware",
"vendor": "gl-inet",
"versions": [
{
"lessThan": "4.4.10",
"status": "affected",
"version": "4.4.9",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:o:gl-inet:gl-mt1300_firmware:-:*:*:*:*:*:*:*",
"cpe:2.3:o:gl-inet:gl-sft1200_firmware:-:*:*:*:*:*:*:*",
"cpe:2.3:o:gl-inet:gl-x750_firmware:-:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "gl-x750_firmware",
"vendor": "gl-inet",
"versions": [
{
"lessThan": "4.3.19",
"status": "affected",
"version": "4.3.18",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:o:gl-inet:gl-ar300m16_firmware:*:*:*:*:*:*:*:*",
"cpe:2.3:o:gl-inet:gl-ar750_firmware:-:*:*:*:*:*:*:*",
"cpe:2.3:o:gl-inet:gl-ar300m_firmware:-:*:*:*:*:*:*:*",
"cpe:2.3:o:gl-inet:gl-ar750s_firmware:-:*:*:*:*:*:*:*",
"cpe:2.3:o:gl-inet:gl-b1300_firmware:-:*:*:*:*:*:*:*",
"cpe:2.3:o:gl-inet:gl-e750_firmware:-:*:*:*:*:*:*:*",
"cpe:2.3:o:gl-inet:gl-mt300n-v2_firmware:-:*:*:*:*:*:*:*",
"cpe:2.3:o:gl-inet:gl-xe300_firmware:-:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "gl-xe300_firmware",
"vendor": "gl-inet",
"versions": [
{
"lessThan": "4.3.18",
"status": "affected",
"version": "4.3.17",
"versionType": "custom"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "ADJACENT_NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2024-45261",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-10-28T19:12:05.989024Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-863",
"description": "CWE-863 Incorrect Authorization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-10-28T19:19:59.290Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "An issue was discovered on certain GL-iNet devices, including MT6000, MT3000, MT2500, AXT1800, and AX1800 4.6.2. The SID generated for a specific user is not tied to that user itself, which allows other users to potentially use it for authentication. Once an attacker bypasses the application\u0027s authentication procedures, they can generate a valid SID, escalate privileges, and gain full control."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-10-24T20:18:25.796Z",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"url": "https://github.com/gl-inet/CVE-issues/blob/main/4.0.0/Bypassing%20Login%20Mechanism%20with%20Passwordless%20User%20Login.md"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2024-45261",
"datePublished": "2024-10-24T00:00:00.000Z",
"dateReserved": "2024-08-25T00:00:00.000Z",
"dateUpdated": "2024-10-28T19:19:59.290Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2024-39228 (GCVE-0-2024-39228)
Vulnerability from cvelistv5 – Published: 2024-08-06 00:00 – Updated: 2024-08-15 15:36
VLAI
EPSS
VEX
Summary
GL-iNet products AR750/AR750S/AR300M/AR300M16/MT300N-V2/B1300/MT1300/SFT1200/X750 v4.3.11, MT3000/MT2500/AXT1800/AX1800/A1300/X300B v4.5.16, XE300 v4.3.16, E750 v4.3.12, AP1300/S1300 v4.3.13, and XE3000/X3000 v4.4 were discovered to contain a shell injection vulnerability via the interface check_ovpn_client_config and check_config.
Severity
9.8 (Critical)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2024-08-08 14:17 UTC
CWE
- n/a
- CWE-78 - Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Assigner
References
1 reference
Impacted products
27 products
| Vendor | Product | Version | |
|---|---|---|---|
| gl-inet | x750_firmware |
Affected:
4.3.11
cpe:2.3:o:gl-inet:x750_firmware:4.3.11:*:*:*:*:*:*:* |
|
| gl-inet | sft1200_firmware |
Affected:
4.3.11
cpe:2.3:o:gl-inet:sft1200_firmware:4.3.11:*:*:*:*:*:*:* |
|
| gl-inet | ar300m_firmware |
Affected:
4.3.11
cpe:2.3:o:gl-inet:ar300m_firmware:4.3.11:*:*:*:*:*:*:* |
|
| gl-inet | ar300m16_firmware |
Affected:
4.3.11
cpe:2.3:o:gl-inet:ar300m16_firmware:4.3.11:*:*:*:*:*:*:* |
|
| gl-inet | ar750_firmware |
Affected:
4.3.11
cpe:2.3:o:gl-inet:ar750_firmware:4.3.11:*:*:*:*:*:*:* |
|
| gl-inet | ar750s_firmware |
Affected:
4.3.11
cpe:2.3:o:gl-inet:ar750s_firmware:4.3.11:*:*:*:*:*:*:* |
|
| gl-inet | b1300_firmware |
Affected:
4.3.11
cpe:2.3:o:gl-inet:b1300_firmware:4.3.11:*:*:*:*:*:*:* |
|
| gl-inet | mt1300_firmware |
Affected:
4.3.11
cpe:2.3:o:gl-inet:mt1300_firmware:4.3.11:*:*:*:*:*:*:* |
|
| gl-inet | mt300n-v2_firmware |
Affected:
4.3.11
cpe:2.3:o:gl-inet:mt300n-v2_firmware:4.3.11:*:*:*:*:*:*:* |
|
| gl-inet | ap1300_firmware |
Affected:
3.217
cpe:2.3:o:gl-inet:ap1300_firmware:3.217:*:*:*:*:*:*:* |
|
| gl-inet | b2200_firmware |
Affected:
3.216
cpe:2.3:o:gl-inet:b2200_firmware:3.216:*:*:*:*:*:*:* |
|
| gl-inet | mv1000_firmware |
Affected:
3.216
cpe:2.3:o:gl-inet:mv1000_firmware:3.216:*:*:*:*:*:*:* |
|
| gl-inet | mv1000w_firmware |
Affected:
3.216
cpe:2.3:o:gl-inet:mv1000w_firmware:3.216:*:*:*:*:*:*:* |
|
| gl-inet | usb150_firmware |
Affected:
3.216
cpe:2.3:o:gl-inet:usb150_firmware:3.216:*:*:*:*:*:*:* |
|
| gl-inet | sf1200_firmware |
Affected:
3.216
cpe:2.3:o:gl-inet:sf1200_firmware:3.216:*:*:*:*:*:*:* |
|
| gl-inet | n300_firmware |
Affected:
3.216
cpe:2.3:o:gl-inet:n300_firmware:3.216:*:*:*:*:*:*:* |
|
| gl-inet | s1300_firmware |
Affected:
3.216
cpe:2.3:o:gl-inet:s1300_firmware:3.216:*:*:*:*:*:*:* |
|
| gl-inet | gl-mt6000_firmware |
Affected:
4.5.8
cpe:2.3:o:gl-inet:gl-mt6000_firmware:4.5.8:*:*:*:*:*:*:* |
|
| gl-inet | a1300_firmware |
Affected:
4.5.16
cpe:2.3:o:gl-inet:a1300_firmware:4.5.16:*:*:*:*:*:*:* |
|
| gl-inet | x300b_firmware |
Affected:
4.5.16
cpe:2.3:o:gl-inet:x300b_firmware:4.5.16:*:*:*:*:*:*:* |
|
| gl-inet | ax1800_firmware |
Affected:
4.5.16
cpe:2.3:o:gl-inet:ax1800_firmware:4.5.16:*:*:*:*:*:*:* |
|
| gl-inet | mt2500_firmware |
Affected:
4.5.16
cpe:2.3:o:gl-inet:mt2500_firmware:4.5.16:*:*:*:*:*:*:* |
|
| gl-inet | mt3000_firmware |
Affected:
4.5.16
cpe:2.3:o:gl-inet:mt3000_firmware:4.5.16:*:*:*:*:*:*:* |
|
| gl-inet | x3000_firmware |
Affected:
4.4.8
cpe:2.3:o:gl-inet:x3000_firmware:4.4.8:*:*:*:*:*:*:* |
|
| gl-inet | xe300_firmware |
Affected:
4.4.8
cpe:2.3:o:gl-inet:xe300_firmware:4.4.8:*:*:*:*:*:*:* |
|
| gl-inet | xe300_firmware |
Affected:
4.3.16
cpe:2.3:o:gl-inet:xe300_firmware:4.3.16:*:*:*:*:*:*:* |
|
| gl-inet | e750_firmware |
Affected:
4.3.12
cpe:2.3:o:gl-inet:e750_firmware:4.3.12:*:*:*:*:*:*:* |
{
"containers": {
"adp": [
{
"affected": [
{
"cpes": [
"cpe:2.3:o:gl-inet:x750_firmware:4.3.11:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "x750_firmware",
"vendor": "gl-inet",
"versions": [
{
"status": "affected",
"version": "4.3.11"
}
]
},
{
"cpes": [
"cpe:2.3:o:gl-inet:sft1200_firmware:4.3.11:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "sft1200_firmware",
"vendor": "gl-inet",
"versions": [
{
"status": "affected",
"version": "4.3.11"
}
]
},
{
"cpes": [
"cpe:2.3:o:gl-inet:ar300m_firmware:4.3.11:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "ar300m_firmware",
"vendor": "gl-inet",
"versions": [
{
"status": "affected",
"version": "4.3.11"
}
]
},
{
"cpes": [
"cpe:2.3:o:gl-inet:ar300m16_firmware:4.3.11:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "ar300m16_firmware",
"vendor": "gl-inet",
"versions": [
{
"status": "affected",
"version": "4.3.11"
}
]
},
{
"cpes": [
"cpe:2.3:o:gl-inet:ar750_firmware:4.3.11:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "ar750_firmware",
"vendor": "gl-inet",
"versions": [
{
"status": "affected",
"version": "4.3.11"
}
]
},
{
"cpes": [
"cpe:2.3:o:gl-inet:ar750s_firmware:4.3.11:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "ar750s_firmware",
"vendor": "gl-inet",
"versions": [
{
"status": "affected",
"version": "4.3.11"
}
]
},
{
"cpes": [
"cpe:2.3:o:gl-inet:b1300_firmware:4.3.11:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "b1300_firmware",
"vendor": "gl-inet",
"versions": [
{
"status": "affected",
"version": "4.3.11"
}
]
},
{
"cpes": [
"cpe:2.3:o:gl-inet:mt1300_firmware:4.3.11:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "mt1300_firmware",
"vendor": "gl-inet",
"versions": [
{
"status": "affected",
"version": "4.3.11"
}
]
},
{
"cpes": [
"cpe:2.3:o:gl-inet:mt300n-v2_firmware:4.3.11:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "mt300n-v2_firmware",
"vendor": "gl-inet",
"versions": [
{
"status": "affected",
"version": "4.3.11"
}
]
},
{
"cpes": [
"cpe:2.3:o:gl-inet:ap1300_firmware:3.217:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "ap1300_firmware",
"vendor": "gl-inet",
"versions": [
{
"status": "affected",
"version": "3.217"
}
]
},
{
"cpes": [
"cpe:2.3:o:gl-inet:b2200_firmware:3.216:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "b2200_firmware",
"vendor": "gl-inet",
"versions": [
{
"status": "affected",
"version": "3.216"
}
]
},
{
"cpes": [
"cpe:2.3:o:gl-inet:mv1000_firmware:3.216:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "mv1000_firmware",
"vendor": "gl-inet",
"versions": [
{
"status": "affected",
"version": "3.216"
}
]
},
{
"cpes": [
"cpe:2.3:o:gl-inet:mv1000w_firmware:3.216:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "mv1000w_firmware",
"vendor": "gl-inet",
"versions": [
{
"status": "affected",
"version": "3.216"
}
]
},
{
"cpes": [
"cpe:2.3:o:gl-inet:usb150_firmware:3.216:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "usb150_firmware",
"vendor": "gl-inet",
"versions": [
{
"status": "affected",
"version": "3.216"
}
]
},
{
"cpes": [
"cpe:2.3:o:gl-inet:sf1200_firmware:3.216:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "sf1200_firmware",
"vendor": "gl-inet",
"versions": [
{
"status": "affected",
"version": "3.216"
}
]
},
{
"cpes": [
"cpe:2.3:o:gl-inet:n300_firmware:3.216:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "n300_firmware",
"vendor": "gl-inet",
"versions": [
{
"status": "affected",
"version": "3.216"
}
]
},
{
"cpes": [
"cpe:2.3:o:gl-inet:s1300_firmware:3.216:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "s1300_firmware",
"vendor": "gl-inet",
"versions": [
{
"status": "affected",
"version": "3.216"
}
]
},
{
"cpes": [
"cpe:2.3:o:gl-inet:gl-mt6000_firmware:4.5.8:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "gl-mt6000_firmware",
"vendor": "gl-inet",
"versions": [
{
"status": "affected",
"version": "4.5.8"
}
]
},
{
"cpes": [
"cpe:2.3:o:gl-inet:a1300_firmware:4.5.16:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "a1300_firmware",
"vendor": "gl-inet",
"versions": [
{
"status": "affected",
"version": "4.5.16"
}
]
},
{
"cpes": [
"cpe:2.3:o:gl-inet:x300b_firmware:4.5.16:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "x300b_firmware",
"vendor": "gl-inet",
"versions": [
{
"status": "affected",
"version": "4.5.16"
}
]
},
{
"cpes": [
"cpe:2.3:o:gl-inet:ax1800_firmware:4.5.16:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "ax1800_firmware",
"vendor": "gl-inet",
"versions": [
{
"status": "affected",
"version": "4.5.16"
}
]
},
{
"cpes": [
"cpe:2.3:o:gl-inet:mt2500_firmware:4.5.16:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "mt2500_firmware",
"vendor": "gl-inet",
"versions": [
{
"status": "affected",
"version": "4.5.16"
}
]
},
{
"cpes": [
"cpe:2.3:o:gl-inet:mt3000_firmware:4.5.16:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "mt3000_firmware",
"vendor": "gl-inet",
"versions": [
{
"status": "affected",
"version": "4.5.16"
}
]
},
{
"cpes": [
"cpe:2.3:o:gl-inet:x3000_firmware:4.4.8:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "x3000_firmware",
"vendor": "gl-inet",
"versions": [
{
"status": "affected",
"version": "4.4.8"
}
]
},
{
"cpes": [
"cpe:2.3:o:gl-inet:xe300_firmware:4.4.8:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "xe300_firmware",
"vendor": "gl-inet",
"versions": [
{
"status": "affected",
"version": "4.4.8"
}
]
},
{
"cpes": [
"cpe:2.3:o:gl-inet:xe300_firmware:4.3.16:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "xe300_firmware",
"vendor": "gl-inet",
"versions": [
{
"status": "affected",
"version": "4.3.16"
}
]
},
{
"cpes": [
"cpe:2.3:o:gl-inet:e750_firmware:4.3.12:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "e750_firmware",
"vendor": "gl-inet",
"versions": [
{
"status": "affected",
"version": "4.3.12"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2024-39228",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-08-08T14:17:52.681206Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-78",
"description": "CWE-78 Improper Neutralization of Special Elements used in an OS Command (\u0027OS Command Injection\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-08-08T14:46:57.158Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "GL-iNet products AR750/AR750S/AR300M/AR300M16/MT300N-V2/B1300/MT1300/SFT1200/X750 v4.3.11, MT3000/MT2500/AXT1800/AX1800/A1300/X300B v4.5.16, XE300 v4.3.16, E750 v4.3.12, AP1300/S1300 v4.3.13, and XE3000/X3000 v4.4 were discovered to contain a shell injection vulnerability via the interface check_ovpn_client_config and check_config."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-08-15T15:36:52.684Z",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"url": "https://github.com/gl-inet/CVE-issues/blob/main/4.0.0/Ovpn%20interface%20shell%20injection.md"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2024-39228",
"datePublished": "2024-08-06T00:00:00.000Z",
"dateReserved": "2024-06-21T00:00:00.000Z",
"dateUpdated": "2024-08-15T15:36:52.684Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2024-39225 (GCVE-0-2024-39225)
Vulnerability from cvelistv5 – Published: 2024-08-06 00:00 – Updated: 2024-08-15 15:31
VLAI
EPSS
VEX
Summary
GL-iNet products AR750/AR750S/AR300M/AR300M16/MT300N-V2/B1300/MT1300/SFT1200/X750 v4.3.11, MT3000/MT2500/AXT1800/AX1800/A1300/X300B v4.5.16, XE300 v4.3.16, E750 v4.3.12, AP1300/S1300 v4.3.13, and XE3000/X3000 v4.4 were discovered to contain a remote code execution (RCE) vulnerability.
Severity
9.8 (Critical)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2024-08-08 14:48 UTC
CWE
- n/a
- CWE-307 - Improper Restriction of Excessive Authentication Attempts
Assigner
References
1 reference
Impacted products
28 products
| Vendor | Product | Version | |
|---|---|---|---|
| gl-inet | mt6000_firmware |
Affected:
4.5.8
cpe:2.3:o:gl-inet:mt6000_firmware:4.5.8:*:*:*:*:*:*:* |
|
| gl-inet | a1300_firmware |
Affected:
4.5.16
cpe:2.3:o:gl-inet:a1300_firmware:4.5.16:*:*:*:*:*:*:* |
|
| gl-inet | x300b_firmware |
Affected:
4.5.16
cpe:2.3:o:gl-inet:x300b_firmware:4.5.16:*:*:*:*:*:*:* |
|
| gl-inet | ax1800_firmware |
Affected:
4.5.16
cpe:2.3:o:gl-inet:ax1800_firmware:4.5.16:*:*:*:*:*:*:* |
|
| gl-inet | axt1800_firmware |
Affected:
4.5.16
cpe:2.3:o:gl-inet:axt1800_firmware:4.5.16:*:*:*:*:*:*:* |
|
| gl-inet | mt2500_firmware |
Affected:
4.5.16
cpe:2.3:o:gl-inet:mt2500_firmware:4.5.16:*:*:*:*:*:*:* |
|
| gl-inet | mt3000_firmware |
Affected:
4.5.16
cpe:2.3:o:gl-inet:mt3000_firmware:4.5.16:*:*:*:*:*:*:* |
|
| gl-inet | x3000_firmware |
Affected:
4.4.8
cpe:2.3:o:gl-inet:x3000_firmware:4.4.8:*:*:*:*:*:*:* |
|
| gl-inet | xe3000_firmware |
Affected:
4.4.8
cpe:2.3:o:gl-inet:xe3000_firmware:4.4.8:*:*:*:*:*:*:* |
|
| gl-inet | xe300_firmware |
Affected:
4.3.16
cpe:2.3:o:gl-inet:xe300_firmware:4.3.16:*:*:*:*:*:*:* |
|
| gl-inet | e750_firmware |
Affected:
4.3.12
cpe:2.3:o:gl-inet:e750_firmware:4.3.12:*:*:*:*:*:*:* |
|
| gl-inet | x750_firmware |
Affected:
4.3.11
cpe:2.3:o:gl-inet:x750_firmware:4.3.11:*:*:*:*:*:*:* |
|
| gl-inet | sft1200_firmware |
Affected:
4.3.11
cpe:2.3:o:gl-inet:sft1200_firmware:4.3.11:*:*:*:*:*:*:* |
|
| gl-inet | ar300m_firmware |
Affected:
4.3.11
cpe:2.3:o:gl-inet:ar300m_firmware:4.3.11:*:*:*:*:*:*:* |
|
| gl-inet | ar300m16_firmware |
Affected:
4.3.11
cpe:2.3:o:gl-inet:ar300m16_firmware:4.3.11:*:*:*:*:*:*:* |
|
| gl-inet | ar750_firmware |
Affected:
4.3.11
cpe:2.3:o:gl-inet:ar750_firmware:4.3.11:*:*:*:*:*:*:* |
|
| gl-inet | ar750s_firmware |
Affected:
4.3.11
cpe:2.3:o:gl-inet:ar750s_firmware:4.3.11:*:*:*:*:*:*:* |
|
| gl-inet | b1300_firmware |
Affected:
4.3.11
cpe:2.3:o:gl-inet:b1300_firmware:4.3.11:*:*:*:*:*:*:* |
|
| gl-inet | mt1300_firmware |
Affected:
4.3.11
cpe:2.3:o:gl-inet:mt1300_firmware:4.3.11:*:*:*:*:*:*:* |
|
| gl-inet | mt300n-v2_firmware |
Affected:
4.3.11
cpe:2.3:o:gl-inet:mt300n-v2_firmware:4.3.11:*:*:*:*:*:*:* |
|
| gl-inet | ap1300_firmware |
Affected:
3.217
cpe:2.3:o:gl-inet:ap1300_firmware:3.217:*:*:*:*:*:*:* |
|
| gl-inet | b2200_firmware |
Affected:
3.216
cpe:2.3:o:gl-inet:b2200_firmware:3.216:*:*:*:*:*:*:* |
|
| gl-inet | mv1000_firmware |
Affected:
3.216
cpe:2.3:o:gl-inet:mv1000_firmware:3.216:*:*:*:*:*:*:* |
|
| gl-inet | mv1000w_firmware |
Affected:
3.216
cpe:2.3:o:gl-inet:mv1000w_firmware:3.216:*:*:*:*:*:*:* |
|
| gl-inet | usb150_firmware |
Affected:
3.216
cpe:2.3:o:gl-inet:usb150_firmware:3.216:*:*:*:*:*:*:* |
|
| gl-inet | sf1200_firmware |
Affected:
3.216
cpe:2.3:o:gl-inet:sf1200_firmware:3.216:*:*:*:*:*:*:* |
|
| gl-inet | n300_firmware |
Affected:
3.216
cpe:2.3:o:gl-inet:n300_firmware:3.216:*:*:*:*:*:*:* |
|
| gl-inet | s1300_firmware |
Affected:
3.216
cpe:2.3:o:gl-inet:s1300_firmware:3.216:*:*:*:*:*:*:* |
{
"containers": {
"adp": [
{
"affected": [
{
"cpes": [
"cpe:2.3:o:gl-inet:mt6000_firmware:4.5.8:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "mt6000_firmware",
"vendor": "gl-inet",
"versions": [
{
"status": "affected",
"version": "4.5.8"
}
]
},
{
"cpes": [
"cpe:2.3:o:gl-inet:a1300_firmware:4.5.16:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "a1300_firmware",
"vendor": "gl-inet",
"versions": [
{
"status": "affected",
"version": "4.5.16"
}
]
},
{
"cpes": [
"cpe:2.3:o:gl-inet:x300b_firmware:4.5.16:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "x300b_firmware",
"vendor": "gl-inet",
"versions": [
{
"status": "affected",
"version": "4.5.16"
}
]
},
{
"cpes": [
"cpe:2.3:o:gl-inet:ax1800_firmware:4.5.16:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "ax1800_firmware",
"vendor": "gl-inet",
"versions": [
{
"status": "affected",
"version": "4.5.16"
}
]
},
{
"cpes": [
"cpe:2.3:o:gl-inet:axt1800_firmware:4.5.16:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "axt1800_firmware",
"vendor": "gl-inet",
"versions": [
{
"status": "affected",
"version": "4.5.16"
}
]
},
{
"cpes": [
"cpe:2.3:o:gl-inet:mt2500_firmware:4.5.16:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "mt2500_firmware",
"vendor": "gl-inet",
"versions": [
{
"status": "affected",
"version": "4.5.16"
}
]
},
{
"cpes": [
"cpe:2.3:o:gl-inet:mt3000_firmware:4.5.16:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "mt3000_firmware",
"vendor": "gl-inet",
"versions": [
{
"status": "affected",
"version": "4.5.16"
}
]
},
{
"cpes": [
"cpe:2.3:o:gl-inet:x3000_firmware:4.4.8:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "x3000_firmware",
"vendor": "gl-inet",
"versions": [
{
"status": "affected",
"version": "4.4.8"
}
]
},
{
"cpes": [
"cpe:2.3:o:gl-inet:xe3000_firmware:4.4.8:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "xe3000_firmware",
"vendor": "gl-inet",
"versions": [
{
"status": "affected",
"version": "4.4.8"
}
]
},
{
"cpes": [
"cpe:2.3:o:gl-inet:xe300_firmware:4.3.16:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "xe300_firmware",
"vendor": "gl-inet",
"versions": [
{
"status": "affected",
"version": "4.3.16"
}
]
},
{
"cpes": [
"cpe:2.3:o:gl-inet:e750_firmware:4.3.12:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "e750_firmware",
"vendor": "gl-inet",
"versions": [
{
"status": "affected",
"version": "4.3.12"
}
]
},
{
"cpes": [
"cpe:2.3:o:gl-inet:x750_firmware:4.3.11:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "x750_firmware",
"vendor": "gl-inet",
"versions": [
{
"status": "affected",
"version": "4.3.11"
}
]
},
{
"cpes": [
"cpe:2.3:o:gl-inet:sft1200_firmware:4.3.11:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "sft1200_firmware",
"vendor": "gl-inet",
"versions": [
{
"status": "affected",
"version": "4.3.11"
}
]
},
{
"cpes": [
"cpe:2.3:o:gl-inet:ar300m_firmware:4.3.11:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "ar300m_firmware",
"vendor": "gl-inet",
"versions": [
{
"status": "affected",
"version": "4.3.11"
}
]
},
{
"cpes": [
"cpe:2.3:o:gl-inet:ar300m16_firmware:4.3.11:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "ar300m16_firmware",
"vendor": "gl-inet",
"versions": [
{
"status": "affected",
"version": "4.3.11"
}
]
},
{
"cpes": [
"cpe:2.3:o:gl-inet:ar750_firmware:4.3.11:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "ar750_firmware",
"vendor": "gl-inet",
"versions": [
{
"status": "affected",
"version": "4.3.11"
}
]
},
{
"cpes": [
"cpe:2.3:o:gl-inet:ar750s_firmware:4.3.11:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "ar750s_firmware",
"vendor": "gl-inet",
"versions": [
{
"status": "affected",
"version": "4.3.11"
}
]
},
{
"cpes": [
"cpe:2.3:o:gl-inet:b1300_firmware:4.3.11:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "b1300_firmware",
"vendor": "gl-inet",
"versions": [
{
"status": "affected",
"version": "4.3.11"
}
]
},
{
"cpes": [
"cpe:2.3:o:gl-inet:mt1300_firmware:4.3.11:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "mt1300_firmware",
"vendor": "gl-inet",
"versions": [
{
"status": "affected",
"version": "4.3.11"
}
]
},
{
"cpes": [
"cpe:2.3:o:gl-inet:mt300n-v2_firmware:4.3.11:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "mt300n-v2_firmware",
"vendor": "gl-inet",
"versions": [
{
"status": "affected",
"version": "4.3.11"
}
]
},
{
"cpes": [
"cpe:2.3:o:gl-inet:ap1300_firmware:3.217:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "ap1300_firmware",
"vendor": "gl-inet",
"versions": [
{
"status": "affected",
"version": "3.217"
}
]
},
{
"cpes": [
"cpe:2.3:o:gl-inet:b2200_firmware:3.216:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "b2200_firmware",
"vendor": "gl-inet",
"versions": [
{
"status": "affected",
"version": "3.216"
}
]
},
{
"cpes": [
"cpe:2.3:o:gl-inet:mv1000_firmware:3.216:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "mv1000_firmware",
"vendor": "gl-inet",
"versions": [
{
"status": "affected",
"version": "3.216"
}
]
},
{
"cpes": [
"cpe:2.3:o:gl-inet:mv1000w_firmware:3.216:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "mv1000w_firmware",
"vendor": "gl-inet",
"versions": [
{
"status": "affected",
"version": "3.216"
}
]
},
{
"cpes": [
"cpe:2.3:o:gl-inet:usb150_firmware:3.216:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "usb150_firmware",
"vendor": "gl-inet",
"versions": [
{
"status": "affected",
"version": "3.216"
}
]
},
{
"cpes": [
"cpe:2.3:o:gl-inet:sf1200_firmware:3.216:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "sf1200_firmware",
"vendor": "gl-inet",
"versions": [
{
"status": "affected",
"version": "3.216"
}
]
},
{
"cpes": [
"cpe:2.3:o:gl-inet:n300_firmware:3.216:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "n300_firmware",
"vendor": "gl-inet",
"versions": [
{
"status": "affected",
"version": "3.216"
}
]
},
{
"cpes": [
"cpe:2.3:o:gl-inet:s1300_firmware:3.216:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "s1300_firmware",
"vendor": "gl-inet",
"versions": [
{
"status": "affected",
"version": "3.216"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2024-39225",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-08-08T14:48:57.143782Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-307",
"description": "CWE-307 Improper Restriction of Excessive Authentication Attempts",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-08-08T15:09:56.428Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "GL-iNet products AR750/AR750S/AR300M/AR300M16/MT300N-V2/B1300/MT1300/SFT1200/X750 v4.3.11, MT3000/MT2500/AXT1800/AX1800/A1300/X300B v4.5.16, XE300 v4.3.16, E750 v4.3.12, AP1300/S1300 v4.3.13, and XE3000/X3000 v4.4 were discovered to contain a remote code execution (RCE) vulnerability."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-08-15T15:31:54.275Z",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"url": "https://github.com/gl-inet/CVE-issues/blob/main/4.0.0/Bypass%20the%20login%20mechanism.md"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2024-39225",
"datePublished": "2024-08-06T00:00:00.000Z",
"dateReserved": "2024-06-21T00:00:00.000Z",
"dateUpdated": "2024-08-15T15:31:54.275Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2024-39227 (GCVE-0-2024-39227)
Vulnerability from cvelistv5 – Published: 2024-08-06 00:00 – Updated: 2024-08-15 15:40
VLAI
EPSS
VEX
Summary
GL-iNet products AR750/AR750S/AR300M/AR300M16/MT300N-V2/B1300/MT1300/SFT1200/X750 v4.3.11, MT3000/MT2500/AXT1800/AX1800/A1300/X300B v4.5.16, XE300 v4.3.16, E750 v4.3.12, AP1300/S1300 v4.3.13, and XE3000/X3000 v4.4 were discovered to contain insecure permissions in the endpoint /cgi-bin/glc. This vulnerability allows unauthenticated attackers to execute arbitrary code or possibly a directory traversal via crafted JSON data.
Severity
9.8 (Critical)
SSVC
Exploitation: poc
Automatable: yes
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2024-08-07 14:01 UTC
CWE
- n/a
- CWE-75 - Failure to Sanitize Special Elements into a Different Plane (Special Element Injection)
Assigner
References
1 reference
Impacted products
21 products
| Vendor | Product | Version | |
|---|---|---|---|
| gl-inet | gl-mt2500 |
Affected:
4.5.16
cpe:2.3:a:gl-inet:gl-mt2500:4.5.16:*:*:*:*:*:*:* |
|
| gl-inet | gl-axt1800 |
Affected:
4.5.16
cpe:2.3:a:gl-inet:gl-axt1800:4.5.16:*:*:*:*:*:*:* |
|
| gl-inet | gl-ax1800 |
Affected:
4.5.16
cpe:2.3:a:gl-inet:gl-ax1800:4.5.16:*:*:*:*:*:*:* |
|
| gl-inet | gl-a1300 |
Affected:
4.5.16
cpe:2.3:a:gl-inet:gl-a1300:4.5.16:*:*:*:*:*:*:* |
|
| gl-inet | gl-x300b |
Affected:
4.5.16
cpe:2.3:a:gl-inet:gl-x300b:4.5.16:*:*:*:*:*:*:* |
|
| gl-inet | gl-xe300 |
Affected:
4.3.16
cpe:2.3:a:gl-inet:gl-xe300:4.3.16:*:*:*:*:*:*:* |
|
| gl-inet | gl-e750 |
Affected:
4.3.12
cpe:2.3:a:gl-inet:gl-e750:4.3.12:*:*:*:*:*:*:* |
|
| gl-inet | gl-ap1300 |
Affected:
4.3.13
cpe:2.3:a:gl-inet:gl-ap1300:4.3.13:*:*:*:*:*:*:* |
|
| gl-inet | gl-s1300 |
Affected:
4.3.13
cpe:2.3:a:gl-inet:gl-s1300:4.3.13:*:*:*:*:*:*:* |
|
| gl-inet | gl-xe3000 |
Affected:
4.4
cpe:2.3:a:gl-inet:gl-xe3000:4.4:*:*:*:*:*:*:* |
|
| gl-inet | gl-x3000 |
Affected:
4.4
cpe:2.3:a:gl-inet:gl-x3000:4.4:*:*:*:*:*:*:* |
|
| gl-inet | gl-ar750 |
Affected:
4.3.11
cpe:2.3:a:gl-inet:gl-ar750:4.3.11:*:*:*:*:*:*:* |
|
| gl-inet | gl-ar750s |
Affected:
4.3.11
cpe:2.3:a:gl-inet:gl-ar750s:4.3.11:*:*:*:*:*:*:* |
|
| gl-inet | gl-ar300m |
Affected:
4.3.11
cpe:2.3:a:gl-inet:gl-ar300m:4.3.11:*:*:*:*:*:*:* |
|
| gl-inet | gl-ar300m16 |
Affected:
4.3.11
cpe:2.3:a:gl-inet:gl-ar300m16:4.3.11:*:*:*:*:*:*:* |
|
| gl-inet | gl-ar300n-v2 |
Affected:
4.3.11
cpe:2.3:a:gl-inet:gl-ar300n-v2:4.3.11:*:*:*:*:*:*:* |
|
| gl-inet | gl-b1300 |
Affected:
4.3.11
cpe:2.3:a:gl-inet:gl-b1300:4.3.11:*:*:*:*:*:*:* |
|
| gl-inet | gl-mt1300 |
Affected:
4.3.11
cpe:2.3:a:gl-inet:gl-mt1300:4.3.11:*:*:*:*:*:*:* |
|
| gl-inet | gl-sft1200 |
Affected:
4.3.11
cpe:2.3:a:gl-inet:gl-sft1200:4.3.11:*:*:*:*:*:*:* |
|
| gl-inet | gl-x750 |
Affected:
4.3.11
cpe:2.3:a:gl-inet:gl-x750:4.3.11:*:*:*:*:*:*:* |
|
| gl-inet | gl-mt3000 |
Affected:
4.5.16
cpe:2.3:a:gl-inet:gl-mt3000:4.5.16:*:*:*:*:*:*:* |
{
"containers": {
"adp": [
{
"affected": [
{
"cpes": [
"cpe:2.3:a:gl-inet:gl-mt2500:4.5.16:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "gl-mt2500",
"vendor": "gl-inet",
"versions": [
{
"status": "affected",
"version": "4.5.16"
}
]
},
{
"cpes": [
"cpe:2.3:a:gl-inet:gl-axt1800:4.5.16:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "gl-axt1800",
"vendor": "gl-inet",
"versions": [
{
"status": "affected",
"version": "4.5.16"
}
]
},
{
"cpes": [
"cpe:2.3:a:gl-inet:gl-ax1800:4.5.16:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "gl-ax1800",
"vendor": "gl-inet",
"versions": [
{
"status": "affected",
"version": "4.5.16"
}
]
},
{
"cpes": [
"cpe:2.3:a:gl-inet:gl-a1300:4.5.16:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "gl-a1300",
"vendor": "gl-inet",
"versions": [
{
"status": "affected",
"version": "4.5.16"
}
]
},
{
"cpes": [
"cpe:2.3:a:gl-inet:gl-x300b:4.5.16:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "gl-x300b",
"vendor": "gl-inet",
"versions": [
{
"status": "affected",
"version": "4.5.16"
}
]
},
{
"cpes": [
"cpe:2.3:a:gl-inet:gl-xe300:4.3.16:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "gl-xe300",
"vendor": "gl-inet",
"versions": [
{
"status": "affected",
"version": "4.3.16"
}
]
},
{
"cpes": [
"cpe:2.3:a:gl-inet:gl-e750:4.3.12:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "gl-e750",
"vendor": "gl-inet",
"versions": [
{
"status": "affected",
"version": "4.3.12"
}
]
},
{
"cpes": [
"cpe:2.3:a:gl-inet:gl-ap1300:4.3.13:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "gl-ap1300",
"vendor": "gl-inet",
"versions": [
{
"status": "affected",
"version": "4.3.13"
}
]
},
{
"cpes": [
"cpe:2.3:a:gl-inet:gl-s1300:4.3.13:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "gl-s1300",
"vendor": "gl-inet",
"versions": [
{
"status": "affected",
"version": "4.3.13"
}
]
},
{
"cpes": [
"cpe:2.3:a:gl-inet:gl-xe3000:4.4:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "gl-xe3000",
"vendor": "gl-inet",
"versions": [
{
"status": "affected",
"version": "4.4"
}
]
},
{
"cpes": [
"cpe:2.3:a:gl-inet:gl-x3000:4.4:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "gl-x3000",
"vendor": "gl-inet",
"versions": [
{
"status": "affected",
"version": "4.4"
}
]
},
{
"cpes": [
"cpe:2.3:a:gl-inet:gl-ar750:4.3.11:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "gl-ar750",
"vendor": "gl-inet",
"versions": [
{
"status": "affected",
"version": "4.3.11"
}
]
},
{
"cpes": [
"cpe:2.3:a:gl-inet:gl-ar750s:4.3.11:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "gl-ar750s",
"vendor": "gl-inet",
"versions": [
{
"status": "affected",
"version": "4.3.11"
}
]
},
{
"cpes": [
"cpe:2.3:a:gl-inet:gl-ar300m:4.3.11:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "gl-ar300m",
"vendor": "gl-inet",
"versions": [
{
"status": "affected",
"version": "4.3.11"
}
]
},
{
"cpes": [
"cpe:2.3:a:gl-inet:gl-ar300m16:4.3.11:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "gl-ar300m16",
"vendor": "gl-inet",
"versions": [
{
"status": "affected",
"version": "4.3.11"
}
]
},
{
"cpes": [
"cpe:2.3:a:gl-inet:gl-ar300n-v2:4.3.11:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "gl-ar300n-v2",
"vendor": "gl-inet",
"versions": [
{
"status": "affected",
"version": "4.3.11"
}
]
},
{
"cpes": [
"cpe:2.3:a:gl-inet:gl-b1300:4.3.11:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "gl-b1300",
"vendor": "gl-inet",
"versions": [
{
"status": "affected",
"version": "4.3.11"
}
]
},
{
"cpes": [
"cpe:2.3:a:gl-inet:gl-mt1300:4.3.11:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "gl-mt1300",
"vendor": "gl-inet",
"versions": [
{
"status": "affected",
"version": "4.3.11"
}
]
},
{
"cpes": [
"cpe:2.3:a:gl-inet:gl-sft1200:4.3.11:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "gl-sft1200",
"vendor": "gl-inet",
"versions": [
{
"status": "affected",
"version": "4.3.11"
}
]
},
{
"cpes": [
"cpe:2.3:a:gl-inet:gl-x750:4.3.11:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "gl-x750",
"vendor": "gl-inet",
"versions": [
{
"status": "affected",
"version": "4.3.11"
}
]
},
{
"cpes": [
"cpe:2.3:a:gl-inet:gl-mt3000:4.5.16:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "gl-mt3000",
"vendor": "gl-inet",
"versions": [
{
"status": "affected",
"version": "4.5.16"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2024-39227",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-08-07T14:01:03.559592Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-75",
"description": "CWE-75 Failure to Sanitize Special Elements into a Different Plane (Special Element Injection)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-08-07T14:56:43.943Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "GL-iNet products AR750/AR750S/AR300M/AR300M16/MT300N-V2/B1300/MT1300/SFT1200/X750 v4.3.11, MT3000/MT2500/AXT1800/AX1800/A1300/X300B v4.5.16, XE300 v4.3.16, E750 v4.3.12, AP1300/S1300 v4.3.13, and XE3000/X3000 v4.4 were discovered to contain insecure permissions in the endpoint /cgi-bin/glc. This vulnerability allows unauthenticated attackers to execute arbitrary code or possibly a directory traversal via crafted JSON data."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-08-15T15:40:35.188Z",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"url": "https://github.com/gl-inet/CVE-issues/blob/main/4.0.0/Access%20to%20the%20C%20library%20without%20logging%20in.md"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2024-39227",
"datePublished": "2024-08-06T00:00:00.000Z",
"dateReserved": "2024-06-21T00:00:00.000Z",
"dateUpdated": "2024-08-15T15:40:35.188Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2024-27356 (GCVE-0-2024-27356)
Vulnerability from cvelistv5 – Published: 2024-02-27 00:00 – Updated: 2025-03-24 15:44
VLAI
EPSS
VEX
Summary
An issue was discovered on certain GL-iNet devices. Attackers can download files such as logs via commands, potentially obtaining critical user information. This affects MT6000 4.5.5, XE3000 4.4.4, X3000 4.4.5, MT3000 4.5.0, MT2500 4.5.0, AXT1800 4.5.0, AX1800 4.5.0, A1300 4.5.0, S200 4.1.4-0300, X750 4.3.7, SFT1200 4.3.7, XE300 4.3.7, MT1300 4.3.10, AR750 4.3.10, AR750S 4.3.10, AR300M 4.3.10, AR300M16 4.3.10, B1300 4.3.10, MT300N-v2 4.3.10, X300B 3.217, S1300 3.216, SF1200 3.216, MV1000 3.216, N300 3.216, B2200 3.216, and X1200 3.203.
Severity
7.5 (High)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2024-02-27 15:51 UTC
CWE
- n/a
- CWE-200 - Exposure of Sensitive Information to an Unauthorized Actor
Assigner
References
2 references
Impacted products
27 products
| Vendor | Product | Version | |
|---|---|---|---|
| gl-inet | mt1300 |
Affected:
4.3.10
cpe:2.3:a:gl-inet:mt1300:4.3.10:*:*:*:*:*:*:* |
|
| gl-inet | ar750 |
Affected:
4.3.10
cpe:2.3:a:gl-inet:ar750:4.3.10:*:*:*:*:*:*:* |
|
| gl-inet | ar750s |
Affected:
4.3.10
cpe:2.3:a:gl-inet:ar750s:4.3.10:*:*:*:*:*:*:* |
|
| gl.inet | MT6000 |
Affected:
4.5.5
cpe:2.3:h:gl.inet:MT6000:-:*:*:*:*:*:*:* |
|
| gl-inet | xe3000 |
Affected:
4.4.4
cpe:2.3:a:gl-inet:xe3000:4.4.4:*:*:*:*:*:*:* |
|
| gl-inet | x3000 |
Affected:
4.4.5
cpe:2.3:a:gl-inet:x3000:4.4.5:*:*:*:*:*:*:* |
|
| gl-inet | mt3000 |
Affected:
4.5.0
cpe:2.3:a:gl-inet:mt3000:4.5.0:*:*:*:*:*:*:* |
|
| gl-inet | mt2500 |
Affected:
4.5.0
cpe:2.3:a:gl-inet:mt2500:4.5.0:*:*:*:*:*:*:* |
|
| gl-inet | axt1800 |
Affected:
4.5.0
cpe:2.3:a:gl-inet:axt1800:4.5.0:*:*:*:*:*:*:* |
|
| gl-inet | ax1800 |
Affected:
4.5.0
cpe:2.3:a:gl-inet:ax1800:4.5.0:*:*:*:*:*:*:* |
|
| gl-inet | a1300 |
Affected:
4.5.0
cpe:2.3:a:gl-inet:a1300:4.5.0:*:*:*:*:*:*:* |
|
| gl-inet | s200 |
Affected:
4.1.4
cpe:2.3:a:gl-inet:s200:4.1.4:*:*:*:*:*:*:* |
|
| gl-inet | 0300 |
Affected:
4.3.7
cpe:2.3:a:gl-inet:0300:*:*:*:*:*:*:*:* |
|
| gl-inet | x750 |
Affected:
4.3.7
cpe:2.3:a:gl-inet:x750:4.3.7:*:*:*:*:*:*:* |
|
| gl-inet | sft1200 |
Affected:
4.3.7
cpe:2.3:a:gl-inet:sft1200:4.3.7:*:*:*:*:*:*:* |
|
| gl-inet | xe300 |
Affected:
4.3.7
cpe:2.3:a:gl-inet:xe300:4.3.7:*:*:*:*:*:*:* |
|
| gl-inet | ar3000m |
Affected:
4.3.10
cpe:2.3:a:gl-inet:ar3000m:4.3.10:*:*:*:*:*:*:* |
|
| gl-inet | ar3000m16 |
Affected:
4.3.10
cpe:2.3:a:gl-inet:ar3000m16:4.3.10:*:*:*:*:*:*:* |
|
| gl-inet | b1300 |
Affected:
4.3.10
cpe:2.3:a:gl-inet:b1300:4.3.10:*:*:*:*:*:*:* |
|
| gl-inet | mt300nv2 |
Affected:
4.3.10
cpe:2.3:a:gl-inet:mt300nv2:4.3.10:*:*:*:*:*:*:* |
|
| gl-inet | x300b |
Affected:
3.217
cpe:2.3:a:gl-inet:x300b:3.217:*:*:*:*:*:*:* |
|
| gl-inet | s1300 |
Affected:
3.216
cpe:2.3:a:gl-inet:s1300:3.216:*:*:*:*:*:*:* |
|
| gl-inet | sf1200 |
Affected:
3.216
cpe:2.3:a:gl-inet:sf1200:3.216:*:*:*:*:*:*:* |
|
| gl-inet | mv1000 |
Affected:
3.216
cpe:2.3:a:gl-inet:mv1000:3.216:*:*:*:*:*:*:* |
|
| gl-inet | n300 |
Affected:
3.216
cpe:2.3:a:gl-inet:n300:3.216:*:*:*:*:*:*:* |
|
| gl-inet | b2200 |
Affected:
3.216
cpe:2.3:a:gl-inet:b2200:3.216:*:*:*:*:*:*:* |
|
| gl-i | x1200 |
Affected:
3.203
cpe:2.3:a:gl-i:x1200:3.203:*:*:*:*:*:*:* |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-02T00:34:51.986Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_transferred"
],
"url": "https://gl-inet.com"
},
{
"tags": [
"x_transferred"
],
"url": "https://github.com/gl-inet/CVE-issues/blob/main/4.0.0/Download_file_vulnerability.md"
}
],
"title": "CVE Program Container"
},
{
"affected": [
{
"cpes": [
"cpe:2.3:a:gl-inet:mt1300:4.3.10:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "mt1300",
"vendor": "gl-inet",
"versions": [
{
"status": "affected",
"version": "4.3.10"
}
]
},
{
"cpes": [
"cpe:2.3:a:gl-inet:ar750:4.3.10:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "ar750",
"vendor": "gl-inet",
"versions": [
{
"status": "affected",
"version": "4.3.10"
}
]
},
{
"cpes": [
"cpe:2.3:a:gl-inet:ar750s:4.3.10:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "ar750s",
"vendor": "gl-inet",
"versions": [
{
"status": "affected",
"version": "4.3.10"
}
]
},
{
"cpes": [
"cpe:2.3:h:gl.inet:MT6000:-:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "MT6000",
"vendor": "gl.inet",
"versions": [
{
"status": "affected",
"version": "4.5.5"
}
]
},
{
"cpes": [
"cpe:2.3:a:gl-inet:xe3000:4.4.4:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "xe3000",
"vendor": "gl-inet",
"versions": [
{
"status": "affected",
"version": "4.4.4"
}
]
},
{
"cpes": [
"cpe:2.3:a:gl-inet:x3000:4.4.5:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "x3000",
"vendor": "gl-inet",
"versions": [
{
"status": "affected",
"version": "4.4.5"
}
]
},
{
"cpes": [
"cpe:2.3:a:gl-inet:mt3000:4.5.0:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "mt3000",
"vendor": "gl-inet",
"versions": [
{
"status": "affected",
"version": "4.5.0"
}
]
},
{
"cpes": [
"cpe:2.3:a:gl-inet:mt2500:4.5.0:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "mt2500",
"vendor": "gl-inet",
"versions": [
{
"status": "affected",
"version": "4.5.0"
}
]
},
{
"cpes": [
"cpe:2.3:a:gl-inet:axt1800:4.5.0:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "axt1800",
"vendor": "gl-inet",
"versions": [
{
"status": "affected",
"version": "4.5.0"
}
]
},
{
"cpes": [
"cpe:2.3:a:gl-inet:ax1800:4.5.0:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "ax1800",
"vendor": "gl-inet",
"versions": [
{
"status": "affected",
"version": "4.5.0"
}
]
},
{
"cpes": [
"cpe:2.3:a:gl-inet:a1300:4.5.0:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "a1300",
"vendor": "gl-inet",
"versions": [
{
"status": "affected",
"version": "4.5.0"
}
]
},
{
"cpes": [
"cpe:2.3:a:gl-inet:s200:4.1.4:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "s200",
"vendor": "gl-inet",
"versions": [
{
"status": "affected",
"version": "4.1.4"
}
]
},
{
"cpes": [
"cpe:2.3:a:gl-inet:0300:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "0300",
"vendor": "gl-inet",
"versions": [
{
"status": "affected",
"version": "4.3.7"
}
]
},
{
"cpes": [
"cpe:2.3:a:gl-inet:x750:4.3.7:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "x750",
"vendor": "gl-inet",
"versions": [
{
"status": "affected",
"version": "4.3.7"
}
]
},
{
"cpes": [
"cpe:2.3:a:gl-inet:sft1200:4.3.7:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "sft1200",
"vendor": "gl-inet",
"versions": [
{
"status": "affected",
"version": "4.3.7"
}
]
},
{
"cpes": [
"cpe:2.3:a:gl-inet:xe300:4.3.7:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "xe300",
"vendor": "gl-inet",
"versions": [
{
"status": "affected",
"version": "4.3.7"
}
]
},
{
"cpes": [
"cpe:2.3:a:gl-inet:ar3000m:4.3.10:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "ar3000m",
"vendor": "gl-inet",
"versions": [
{
"status": "affected",
"version": "4.3.10"
}
]
},
{
"cpes": [
"cpe:2.3:a:gl-inet:ar3000m16:4.3.10:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "ar3000m16",
"vendor": "gl-inet",
"versions": [
{
"status": "affected",
"version": "4.3.10"
}
]
},
{
"cpes": [
"cpe:2.3:a:gl-inet:b1300:4.3.10:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "b1300",
"vendor": "gl-inet",
"versions": [
{
"status": "affected",
"version": "4.3.10"
}
]
},
{
"cpes": [
"cpe:2.3:a:gl-inet:mt300nv2:4.3.10:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "mt300nv2",
"vendor": "gl-inet",
"versions": [
{
"status": "affected",
"version": "4.3.10"
}
]
},
{
"cpes": [
"cpe:2.3:a:gl-inet:x300b:3.217:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "x300b",
"vendor": "gl-inet",
"versions": [
{
"status": "affected",
"version": "3.217"
}
]
},
{
"cpes": [
"cpe:2.3:a:gl-inet:s1300:3.216:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "s1300",
"vendor": "gl-inet",
"versions": [
{
"status": "affected",
"version": "3.216"
}
]
},
{
"cpes": [
"cpe:2.3:a:gl-inet:sf1200:3.216:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "sf1200",
"vendor": "gl-inet",
"versions": [
{
"status": "affected",
"version": "3.216"
}
]
},
{
"cpes": [
"cpe:2.3:a:gl-inet:mv1000:3.216:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "mv1000",
"vendor": "gl-inet",
"versions": [
{
"status": "affected",
"version": "3.216"
}
]
},
{
"cpes": [
"cpe:2.3:a:gl-inet:n300:3.216:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "n300",
"vendor": "gl-inet",
"versions": [
{
"status": "affected",
"version": "3.216"
}
]
},
{
"cpes": [
"cpe:2.3:a:gl-inet:b2200:3.216:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "b2200",
"vendor": "gl-inet",
"versions": [
{
"status": "affected",
"version": "3.216"
}
]
},
{
"cpes": [
"cpe:2.3:a:gl-i:x1200:3.203:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "x1200",
"vendor": "gl-i",
"versions": [
{
"status": "affected",
"version": "3.203"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2024-27356",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-02-27T15:51:15.040940Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-200",
"description": "CWE-200 Exposure of Sensitive Information to an Unauthorized Actor",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-03-24T15:44:54.024Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "An issue was discovered on certain GL-iNet devices. Attackers can download files such as logs via commands, potentially obtaining critical user information. This affects MT6000 4.5.5, XE3000 4.4.4, X3000 4.4.5, MT3000 4.5.0, MT2500 4.5.0, AXT1800 4.5.0, AX1800 4.5.0, A1300 4.5.0, S200 4.1.4-0300, X750 4.3.7, SFT1200 4.3.7, XE300 4.3.7, MT1300 4.3.10, AR750 4.3.10, AR750S 4.3.10, AR300M 4.3.10, AR300M16 4.3.10, B1300 4.3.10, MT300N-v2 4.3.10, X300B 3.217, S1300 3.216, SF1200 3.216, MV1000 3.216, N300 3.216, B2200 3.216, and X1200 3.203."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-02-27T00:17:16.406Z",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"url": "https://gl-inet.com"
},
{
"url": "https://github.com/gl-inet/CVE-issues/blob/main/4.0.0/Download_file_vulnerability.md"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2024-27356",
"datePublished": "2024-02-27T00:00:00.000Z",
"dateReserved": "2024-02-25T00:00:00.000Z",
"dateUpdated": "2025-03-24T15:44:54.024Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2023-47463 (GCVE-0-2023-47463)
Vulnerability from cvelistv5 – Published: 2023-11-30 00:00 – Updated: 2024-10-16 19:26
VLAI
EPSS
VEX
Summary
Insecure Permissions vulnerability in GL.iNet AX1800 version 4.0.0 before 4.5.0 allows a remote attacker to execute arbitrary code via a crafted script to the gl_nas_sys authentication function.
Severity
9.8 (Critical)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2024-10-15 17:36 UTC
CWE
- n/a
- CWE-281 - Improper Preservation of Permissions
Assigner
References
1 reference
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| gl-inet | gl-ax1800_firmware |
Affected:
4.0.0 , < 4.5.0
(custom)
cpe:2.3:o:gl-inet:gl-ax1800_firmware:*:*:*:*:*:*:*:* |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-02T21:09:37.349Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_transferred"
],
"url": "https://github.com/gl-inet/CVE-issues/blob/main/4.0.0/an%20unauthenticated%20remote%20code%20execution.md"
}
],
"title": "CVE Program Container"
},
{
"affected": [
{
"cpes": [
"cpe:2.3:o:gl-inet:gl-ax1800_firmware:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "gl-ax1800_firmware",
"vendor": "gl-inet",
"versions": [
{
"lessThan": "4.5.0",
"status": "affected",
"version": "4.0.0",
"versionType": "custom"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2023-47463",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-10-15T17:36:12.639141Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-281",
"description": "CWE-281 Improper Preservation of Permissions",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-10-16T19:26:54.942Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Insecure Permissions vulnerability in GL.iNet AX1800 version 4.0.0 before 4.5.0 allows a remote attacker to execute arbitrary code via a crafted script to the gl_nas_sys authentication function."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2023-11-30T04:29:34.881Z",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"url": "https://github.com/gl-inet/CVE-issues/blob/main/4.0.0/an%20unauthenticated%20remote%20code%20execution.md"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2023-47463",
"datePublished": "2023-11-30T00:00:00.000Z",
"dateReserved": "2023-11-06T00:00:00.000Z",
"dateUpdated": "2024-10-16T19:26:54.942Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}