CVE-2024-45263

An issue was discovered on certain GL-iNet devices, including MT6000, MT3000, MT2500, AXT1800, and AX1800 4.6.2. The upload interface allows the uploading of arbitrary files to the device. Once the device executes the files, it can lead to information leakage, enabling complete control.

Score

CVSS 3.1 8.8 High

Status

Analyzed - cve@mitre.org

Published

2024-10-24

Last modified

2024-10-28

Weaknesses

CWE-434

Affected products

• A1300 Firmware (Gl-inet)
• Ar300m16 Firmware (Gl-inet)
• Ar300m Firmware (Gl-inet)
• Ar750 Firmware (Gl-inet)
• Ar750s Firmware (Gl-inet)
• Ax1800 Firmware (Gl-inet)
• Axt1800 Firmware (Gl-inet)
• B1300 Firmware (Gl-inet)
• B3000 Firmware (Gl-inet)
• E750 Firmware (Gl-inet)
• Gl-a1300 Firmware (Gl-inet)
• Gl-ar300m16 Firmware (Gl-inet)
• Gl-ar300m Firmware (Gl-inet)
• Gl-ar750 Firmware (Gl-inet)
• Gl-ar750s Firmware (Gl-inet)
• Gl-ax1800 Firmware (Gl-inet)
• Gl-axt1800 Firmware (Gl-inet)
• Gl-b1300 Firmware (Gl-inet)
• Gl-b3000 Firmware (Gl-inet)
• Gl-e750 Firmware (Gl-inet)
• Gl-mt1300 Firmware (Gl-inet)
• Gl-mt2500 Firmware (Gl-inet)
• Gl-mt3000 Firmware (Gl-inet)
• Gl-mt300n-v2 Firmware (Gl-inet)
• Gl-mt6000 Firmware (Gl-inet)
• Gl-sft1200 Firmware (Gl-inet)
• Gl-x3000 Firmware (Gl-inet)
• Gl-x300b Firmware (Gl-inet)
• Gl-x750 Firmware (Gl-inet)
• Gl-xe300 Firmware (Gl-inet)
• Mt1300 Firmware (Gl-inet)
• Mt2500 Firmware (Gl-inet)
• Mt3000 Firmware (Gl-inet)
• Mt300n-v2 Firmware (Gl-inet)
• Mt6000 Firmware (Gl-inet)
• Sft1200 Firmware (Gl-inet)
• X3000 Firmware (Gl-inet)
• X300b Firmware (Gl-inet)
• X750 Firmware (Gl-inet)
• Xe3000 Firmware (Gl-inet)
• Xe300 Firmware (Gl-inet)

References

• https://github.com/gl-inet/CVE-issues/blob/main/4.0.0/Arbitrary%20File%20Upload%20to%20ovpn_upload%20via%20Upload%20Int…