github.com
https://github.com/gl-inet/CVE-issues/blob/main/4.0.0/Download_file_vulnerability.md CVE-2024-27356
HIGH
GL-iNet MT6000 4.5.5 - Arbitrary File Download
Record summary
CVE-2024-27356 has a selected CVSS score of 7.5 (high); EIP currently links 1 catalogued exploit.
Description
An issue was discovered on certain GL-iNet devices. Attackers can download files such as logs via commands, potentially obtaining critical user information. This affects MT6000 4.5.5, XE3000 4.4.4, X3000 4.4.5, MT3000 4.5.0, MT2500 4.5.0, AXT1800 4.5.0, AX1800 4.5.0, A1300 4.5.0, S200 4.1.4-0300, X750 4.3.7, SFT1200 4.3.7, XE300 4.3.7, MT1300 4.3.10, AR750 4.3.10, AR750S 4.3.10, AR300M 4.3.10, AR300M16 4.3.10, B1300 4.3.10, MT300N-v2 4.3.10, X300B 3.217, S1300 3.216, SF1200 3.216, MV1000 3.216, N300 3.216, B2200 3.216, and X1200 3.203.
Description source: CVE List
Exploitation context
Available material
- Catalogued exploits
- 1
CISA SSVC decision
ExploitationNone
AutomatableYes
Technical impactPartial
CISA Coordinator · SSVC 2.0.3 · Evaluated Feb 27, 2024 · Source: CVE List
Affected products and versions
Showing 12 of 27| Product | Source | Version range | Status |
|---|---|---|---|
x1200Browse gl-i / x1200Default status: unknown | CVE List | 3.203 | affected |
Default status: unknown | CVE List | 4.3.7 | affected |
Default status: unknown | CVE List | 4.5.0 | affected |
ar3000mBrowse gl-inet / ar3000mDefault status: unknown | CVE List | 4.3.10 | affected |
ar3000m16Browse gl-inet / ar3000m16Default status: unknown | CVE List | 4.3.10 | affected |
Default status: unknown | CVE List | 4.3.10 | affected |
ar750sBrowse gl-inet / ar750sDefault status: unknown | CVE List | 4.3.10 | affected |
ax1800Browse gl-inet / ax1800Default status: unknown | CVE List | 4.5.0 | affected |
axt1800Browse gl-inet / axt1800Default status: unknown | CVE List | 4.5.0 | affected |
Default status: unknown | CVE List | 4.3.10 | affected |
Default status: unknown | CVE List | 3.216 | affected |
mt1300Browse gl-inet / mt1300Default status: unknown | CVE List | 4.3.10 | affected |
Proofs of concept
1Catalogued exploits
ExploitDBGL-iNet MT6000 4.5.5 - Arbitrary File DownloadExploitDB exploitby Bandar AlharbiNot analyzed1 file
References
3gl-inet.com
https://gl-inet.com/ nvd.nist.gov
https://nvd.nist.gov/vuln/detail/CVE-2024-27356