gl-inet Vulnerabilities and Affected Products
Vulnerabilities associated with gl-xe300_firmware.
Products
Clear product- GL-MT30006 vulnerabilities
- gl-mt6000_firmware6 vulnerabilities
- gl-b3000_firmware5 vulnerabilities
- gl-x300b_firmware5 vulnerabilities
- gl-x750_firmware5 vulnerabilities
- gl-xe300_firmware5 vulnerabilities
- Comet KVM4 vulnerabilities
- a1300_firmware2 vulnerabilities
- ap1300_firmware2 vulnerabilities
- ar300m16_firmware2 vulnerabilities
- ar300m_firmware2 vulnerabilities
- ar750_firmware2 vulnerabilities
- ar750s_firmware2 vulnerabilities
- ax1800_firmware2 vulnerabilities
- b1300_firmware2 vulnerabilities
- b2200_firmware2 vulnerabilities
- e750_firmware2 vulnerabilities
- gl-ax1800_firmware2 vulnerabilities
- GL-AXT18002 vulnerabilities
- mt1300_firmware2 vulnerabilities
- mt2500_firmware2 vulnerabilities
- mt3000_firmware2 vulnerabilities
- mt300n-v2_firmware2 vulnerabilities
- mv1000_firmware2 vulnerabilities
- mv1000w_firmware2 vulnerabilities
| Vulnerability | Title and context | CVSS | EPSS | PoCs | Signals | STIX action |
|---|---|---|---|---|---|---|
CVE-2024-45259MEDIUM | An issue was discovered on certain GL-iNet devices, including MT6000, MT3000, MT2500, AXT1800, and AX1800 4.6.2. By intercepting an HTTP request and changing the filename property in the download interface, any file on the device can be deleted. CWE-326Oct 24, 2024 | CVSS6.5v3.1 | EPSS0.227% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2024-45262HIGH | An issue was discovered on certain GL-iNet devices, including MT6000, MT3000, MT2500, AXT1800, and AX1800 4.6.2. The params parameter in the call method of the /rpc endpoint is vulnerable to arbitrary directory traversal, which enables attackers to execute scripts under any path. CWE-22Oct 24, 2024 | CVSS8.8v3.1 | EPSS0.666% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2024-45260HIGH | An issue was discovered on certain GL-iNet devices, including MT6000, MT3000, MT2500, AXT1800, and AX1800 4.6.2. Users who belong to unauthorized groups can invoke any interface of the device, thereby gaining complete control over it. CWE-863Oct 24, 2024 | CVSS8.0v3.1 | EPSS3.98% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2024-45261HIGH | An issue was discovered on certain GL-iNet devices, including MT6000, MT3000, MT2500, AXT1800, and AX1800 4.6.2. The SID generated for a specific user is not tied to that user itself, which allows other users to potentially use it for authentication. Once an attacker bypasses the application's authentication procedures, they can generate a valid SID, escalate privileges, and gain full control. CWE-863Oct 24, 2024 | CVSS8.0v3.1 | EPSS0.494% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2024-45263HIGH | An issue was discovered on certain GL-iNet devices, including MT6000, MT3000, MT2500, AXT1800, and AX1800 4.6.2. The upload interface allows the uploading of arbitrary files to the device. Once the device executes the files, it can lead to information leakage, enabling complete control. CWE-434Oct 24, 2024 | CVSS8.8v3.1 | EPSS0.27% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |