CVE-2024-45260
An issue was discovered on certain GL-iNet devices, including MT6000, MT3000, MT2500, AXT1800, and AX1800 4.6.2. Users who belong to unauthorized groups can invoke any interface of the device, thereby gaining complete control over it.
- Score
- CVSS 3.1 8.0 High
- Status
- Analyzed - cve@mitre.org
- Published
- 2024-10-24
- Last modified
- 2024-10-28
- Weaknesses
- CWE-863
Affected products
- A1300 Firmware (Gl-inet)
- Ar300m16 Firmware (Gl-inet)
- Ar300m Firmware (Gl-inet)
- Ar750 Firmware (Gl-inet)
- Ar750s Firmware (Gl-inet)
- Ax1800 Firmware (Gl-inet)
- Axt1800 Firmware (Gl-inet)
- B1300 Firmware (Gl-inet)
- B3000 Firmware (Gl-inet)
- E750 Firmware (Gl-inet)
- Gl-a1300 Firmware (Gl-inet)
- Gl-ar300m16 Firmware (Gl-inet)
- Gl-ar300m Firmware (Gl-inet)
- Gl-ar750 Firmware (Gl-inet)
- Gl-ar750s Firmware (Gl-inet)
- Gl-ax1800 Firmware (Gl-inet)
- Gl-axt1800 Firmware (Gl-inet)
- Gl-b1300 Firmware (Gl-inet)
- Gl-b3000 Firmware (Gl-inet)
- Gl-e750 Firmware (Gl-inet)
- Gl-mt1300 Firmware (Gl-inet)
- Gl-mt2500 Firmware (Gl-inet)
- Gl-mt3000 Firmware (Gl-inet)
- Gl-mt300n-v2 Firmware (Gl-inet)
- Gl-mt6000 Firmware (Gl-inet)
- Gl-sft1200 Firmware (Gl-inet)
- Gl-x3000 Firmware (Gl-inet)
- Gl-x300b Firmware (Gl-inet)
- Gl-x750 Firmware (Gl-inet)
- Gl-xe300 Firmware (Gl-inet)
- Mt1300 Firmware (Gl-inet)
- Mt2500 Firmware (Gl-inet)
- Mt3000 Firmware (Gl-inet)
- Mt300n-v2 Firmware (Gl-inet)
- Mt6000 Firmware (Gl-inet)
- Sft1200 Firmware (Gl-inet)
- X3000 Firmware (Gl-inet)
- X300b Firmware (Gl-inet)
- X750 Firmware (Gl-inet)
- Xe3000 Firmware (Gl-inet)
- Xe300 Firmware (Gl-inet)
References
- https://github.com/gl-inet/CVE-issues/blob/main/4.0.0/Unauthorized%20Access%20to%20File%20Download%20and%20Upload%20Int…
