Search
Find a vulnerability
Search criteria
12 vulnerabilities found for b2200_firmware by gl-inet
CVE-2024-39229 (GCVE-0-2024-39229)
Vulnerability from nvd – Published: 2024-08-06 00:00 – Updated: 2024-11-21 18:43
VLAI
EPSS
VEX
Summary
An issue in GL-iNet products AR750/AR750S/AR300M/AR300M16/MT300N-V2/B1300/MT1300/SFT1200/X750 v4.3.11, MT3000/MT2500/AXT1800/AX1800/A1300/X300B v4.5.16, XE300 v4.3.16, E750 v4.3.12, AP1300/S1300 v4.3.13, XE3000/X3000 v4, and B2200/MV1000/MV1000W/USB150/N300/SF1200 v3.216 allows attackers to intercept communications via a man-in-the-middle attack when DDNS clients are reporting data to the server.
Severity
6.5 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2024-08-08 15:41 UTC
CWE
- n/a
- CWE-924 - Improper Enforcement of Message Integrity During Transmission in a Communication Channel
Assigner
References
1 reference
{
"containers": {
"adp": [
{
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2024-39229",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-08-08T15:41:13.508119Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-924",
"description": "CWE-924 Improper Enforcement of Message Integrity During Transmission in a Communication Channel",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-11-21T18:43:08.245Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "An issue in GL-iNet products AR750/AR750S/AR300M/AR300M16/MT300N-V2/B1300/MT1300/SFT1200/X750 v4.3.11, MT3000/MT2500/AXT1800/AX1800/A1300/X300B v4.5.16, XE300 v4.3.16, E750 v4.3.12, AP1300/S1300 v4.3.13, XE3000/X3000 v4, and B2200/MV1000/MV1000W/USB150/N300/SF1200 v3.216 allows attackers to intercept communications via a man-in-the-middle attack when DDNS clients are reporting data to the server."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-08-15T15:34:59.730Z",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"url": "https://github.com/gl-inet/CVE-issues/blob/main/4.0.0/DDNS%20data%20is%20not%20encrypted.md"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2024-39229",
"datePublished": "2024-08-06T00:00:00.000Z",
"dateReserved": "2024-06-21T00:00:00.000Z",
"dateUpdated": "2024-11-21T18:43:08.245Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2024-39227 (GCVE-0-2024-39227)
Vulnerability from nvd – Published: 2024-08-06 00:00 – Updated: 2024-08-15 15:40
VLAI
EPSS
VEX
Summary
GL-iNet products AR750/AR750S/AR300M/AR300M16/MT300N-V2/B1300/MT1300/SFT1200/X750 v4.3.11, MT3000/MT2500/AXT1800/AX1800/A1300/X300B v4.5.16, XE300 v4.3.16, E750 v4.3.12, AP1300/S1300 v4.3.13, and XE3000/X3000 v4.4 were discovered to contain insecure permissions in the endpoint /cgi-bin/glc. This vulnerability allows unauthenticated attackers to execute arbitrary code or possibly a directory traversal via crafted JSON data.
Severity
9.8 (Critical)
SSVC
Exploitation: poc
Automatable: yes
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2024-08-07 14:01 UTC
CWE
- n/a
- CWE-75 - Failure to Sanitize Special Elements into a Different Plane (Special Element Injection)
Assigner
References
1 reference
Impacted products
21 products
| Vendor | Product | Version | |
|---|---|---|---|
| gl-inet | gl-mt2500 |
Affected:
4.5.16
cpe:2.3:a:gl-inet:gl-mt2500:4.5.16:*:*:*:*:*:*:* |
|
| gl-inet | gl-axt1800 |
Affected:
4.5.16
cpe:2.3:a:gl-inet:gl-axt1800:4.5.16:*:*:*:*:*:*:* |
|
| gl-inet | gl-ax1800 |
Affected:
4.5.16
cpe:2.3:a:gl-inet:gl-ax1800:4.5.16:*:*:*:*:*:*:* |
|
| gl-inet | gl-a1300 |
Affected:
4.5.16
cpe:2.3:a:gl-inet:gl-a1300:4.5.16:*:*:*:*:*:*:* |
|
| gl-inet | gl-x300b |
Affected:
4.5.16
cpe:2.3:a:gl-inet:gl-x300b:4.5.16:*:*:*:*:*:*:* |
|
| gl-inet | gl-xe300 |
Affected:
4.3.16
cpe:2.3:a:gl-inet:gl-xe300:4.3.16:*:*:*:*:*:*:* |
|
| gl-inet | gl-e750 |
Affected:
4.3.12
cpe:2.3:a:gl-inet:gl-e750:4.3.12:*:*:*:*:*:*:* |
|
| gl-inet | gl-ap1300 |
Affected:
4.3.13
cpe:2.3:a:gl-inet:gl-ap1300:4.3.13:*:*:*:*:*:*:* |
|
| gl-inet | gl-s1300 |
Affected:
4.3.13
cpe:2.3:a:gl-inet:gl-s1300:4.3.13:*:*:*:*:*:*:* |
|
| gl-inet | gl-xe3000 |
Affected:
4.4
cpe:2.3:a:gl-inet:gl-xe3000:4.4:*:*:*:*:*:*:* |
|
| gl-inet | gl-x3000 |
Affected:
4.4
cpe:2.3:a:gl-inet:gl-x3000:4.4:*:*:*:*:*:*:* |
|
| gl-inet | gl-ar750 |
Affected:
4.3.11
cpe:2.3:a:gl-inet:gl-ar750:4.3.11:*:*:*:*:*:*:* |
|
| gl-inet | gl-ar750s |
Affected:
4.3.11
cpe:2.3:a:gl-inet:gl-ar750s:4.3.11:*:*:*:*:*:*:* |
|
| gl-inet | gl-ar300m |
Affected:
4.3.11
cpe:2.3:a:gl-inet:gl-ar300m:4.3.11:*:*:*:*:*:*:* |
|
| gl-inet | gl-ar300m16 |
Affected:
4.3.11
cpe:2.3:a:gl-inet:gl-ar300m16:4.3.11:*:*:*:*:*:*:* |
|
| gl-inet | gl-ar300n-v2 |
Affected:
4.3.11
cpe:2.3:a:gl-inet:gl-ar300n-v2:4.3.11:*:*:*:*:*:*:* |
|
| gl-inet | gl-b1300 |
Affected:
4.3.11
cpe:2.3:a:gl-inet:gl-b1300:4.3.11:*:*:*:*:*:*:* |
|
| gl-inet | gl-mt1300 |
Affected:
4.3.11
cpe:2.3:a:gl-inet:gl-mt1300:4.3.11:*:*:*:*:*:*:* |
|
| gl-inet | gl-sft1200 |
Affected:
4.3.11
cpe:2.3:a:gl-inet:gl-sft1200:4.3.11:*:*:*:*:*:*:* |
|
| gl-inet | gl-x750 |
Affected:
4.3.11
cpe:2.3:a:gl-inet:gl-x750:4.3.11:*:*:*:*:*:*:* |
|
| gl-inet | gl-mt3000 |
Affected:
4.5.16
cpe:2.3:a:gl-inet:gl-mt3000:4.5.16:*:*:*:*:*:*:* |
{
"containers": {
"adp": [
{
"affected": [
{
"cpes": [
"cpe:2.3:a:gl-inet:gl-mt2500:4.5.16:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "gl-mt2500",
"vendor": "gl-inet",
"versions": [
{
"status": "affected",
"version": "4.5.16"
}
]
},
{
"cpes": [
"cpe:2.3:a:gl-inet:gl-axt1800:4.5.16:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "gl-axt1800",
"vendor": "gl-inet",
"versions": [
{
"status": "affected",
"version": "4.5.16"
}
]
},
{
"cpes": [
"cpe:2.3:a:gl-inet:gl-ax1800:4.5.16:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "gl-ax1800",
"vendor": "gl-inet",
"versions": [
{
"status": "affected",
"version": "4.5.16"
}
]
},
{
"cpes": [
"cpe:2.3:a:gl-inet:gl-a1300:4.5.16:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "gl-a1300",
"vendor": "gl-inet",
"versions": [
{
"status": "affected",
"version": "4.5.16"
}
]
},
{
"cpes": [
"cpe:2.3:a:gl-inet:gl-x300b:4.5.16:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "gl-x300b",
"vendor": "gl-inet",
"versions": [
{
"status": "affected",
"version": "4.5.16"
}
]
},
{
"cpes": [
"cpe:2.3:a:gl-inet:gl-xe300:4.3.16:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "gl-xe300",
"vendor": "gl-inet",
"versions": [
{
"status": "affected",
"version": "4.3.16"
}
]
},
{
"cpes": [
"cpe:2.3:a:gl-inet:gl-e750:4.3.12:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "gl-e750",
"vendor": "gl-inet",
"versions": [
{
"status": "affected",
"version": "4.3.12"
}
]
},
{
"cpes": [
"cpe:2.3:a:gl-inet:gl-ap1300:4.3.13:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "gl-ap1300",
"vendor": "gl-inet",
"versions": [
{
"status": "affected",
"version": "4.3.13"
}
]
},
{
"cpes": [
"cpe:2.3:a:gl-inet:gl-s1300:4.3.13:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "gl-s1300",
"vendor": "gl-inet",
"versions": [
{
"status": "affected",
"version": "4.3.13"
}
]
},
{
"cpes": [
"cpe:2.3:a:gl-inet:gl-xe3000:4.4:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "gl-xe3000",
"vendor": "gl-inet",
"versions": [
{
"status": "affected",
"version": "4.4"
}
]
},
{
"cpes": [
"cpe:2.3:a:gl-inet:gl-x3000:4.4:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "gl-x3000",
"vendor": "gl-inet",
"versions": [
{
"status": "affected",
"version": "4.4"
}
]
},
{
"cpes": [
"cpe:2.3:a:gl-inet:gl-ar750:4.3.11:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "gl-ar750",
"vendor": "gl-inet",
"versions": [
{
"status": "affected",
"version": "4.3.11"
}
]
},
{
"cpes": [
"cpe:2.3:a:gl-inet:gl-ar750s:4.3.11:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "gl-ar750s",
"vendor": "gl-inet",
"versions": [
{
"status": "affected",
"version": "4.3.11"
}
]
},
{
"cpes": [
"cpe:2.3:a:gl-inet:gl-ar300m:4.3.11:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "gl-ar300m",
"vendor": "gl-inet",
"versions": [
{
"status": "affected",
"version": "4.3.11"
}
]
},
{
"cpes": [
"cpe:2.3:a:gl-inet:gl-ar300m16:4.3.11:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "gl-ar300m16",
"vendor": "gl-inet",
"versions": [
{
"status": "affected",
"version": "4.3.11"
}
]
},
{
"cpes": [
"cpe:2.3:a:gl-inet:gl-ar300n-v2:4.3.11:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "gl-ar300n-v2",
"vendor": "gl-inet",
"versions": [
{
"status": "affected",
"version": "4.3.11"
}
]
},
{
"cpes": [
"cpe:2.3:a:gl-inet:gl-b1300:4.3.11:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "gl-b1300",
"vendor": "gl-inet",
"versions": [
{
"status": "affected",
"version": "4.3.11"
}
]
},
{
"cpes": [
"cpe:2.3:a:gl-inet:gl-mt1300:4.3.11:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "gl-mt1300",
"vendor": "gl-inet",
"versions": [
{
"status": "affected",
"version": "4.3.11"
}
]
},
{
"cpes": [
"cpe:2.3:a:gl-inet:gl-sft1200:4.3.11:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "gl-sft1200",
"vendor": "gl-inet",
"versions": [
{
"status": "affected",
"version": "4.3.11"
}
]
},
{
"cpes": [
"cpe:2.3:a:gl-inet:gl-x750:4.3.11:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "gl-x750",
"vendor": "gl-inet",
"versions": [
{
"status": "affected",
"version": "4.3.11"
}
]
},
{
"cpes": [
"cpe:2.3:a:gl-inet:gl-mt3000:4.5.16:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "gl-mt3000",
"vendor": "gl-inet",
"versions": [
{
"status": "affected",
"version": "4.5.16"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2024-39227",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-08-07T14:01:03.559592Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-75",
"description": "CWE-75 Failure to Sanitize Special Elements into a Different Plane (Special Element Injection)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-08-07T14:56:43.943Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "GL-iNet products AR750/AR750S/AR300M/AR300M16/MT300N-V2/B1300/MT1300/SFT1200/X750 v4.3.11, MT3000/MT2500/AXT1800/AX1800/A1300/X300B v4.5.16, XE300 v4.3.16, E750 v4.3.12, AP1300/S1300 v4.3.13, and XE3000/X3000 v4.4 were discovered to contain insecure permissions in the endpoint /cgi-bin/glc. This vulnerability allows unauthenticated attackers to execute arbitrary code or possibly a directory traversal via crafted JSON data."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-08-15T15:40:35.188Z",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"url": "https://github.com/gl-inet/CVE-issues/blob/main/4.0.0/Access%20to%20the%20C%20library%20without%20logging%20in.md"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2024-39227",
"datePublished": "2024-08-06T00:00:00.000Z",
"dateReserved": "2024-06-21T00:00:00.000Z",
"dateUpdated": "2024-08-15T15:40:35.188Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2024-39228 (GCVE-0-2024-39228)
Vulnerability from nvd – Published: 2024-08-06 00:00 – Updated: 2024-08-15 15:36
VLAI
EPSS
VEX
Summary
GL-iNet products AR750/AR750S/AR300M/AR300M16/MT300N-V2/B1300/MT1300/SFT1200/X750 v4.3.11, MT3000/MT2500/AXT1800/AX1800/A1300/X300B v4.5.16, XE300 v4.3.16, E750 v4.3.12, AP1300/S1300 v4.3.13, and XE3000/X3000 v4.4 were discovered to contain a shell injection vulnerability via the interface check_ovpn_client_config and check_config.
Severity
9.8 (Critical)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2024-08-08 14:17 UTC
CWE
- n/a
- CWE-78 - Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Assigner
References
1 reference
Impacted products
27 products
| Vendor | Product | Version | |
|---|---|---|---|
| gl-inet | x750_firmware |
Affected:
4.3.11
cpe:2.3:o:gl-inet:x750_firmware:4.3.11:*:*:*:*:*:*:* |
|
| gl-inet | sft1200_firmware |
Affected:
4.3.11
cpe:2.3:o:gl-inet:sft1200_firmware:4.3.11:*:*:*:*:*:*:* |
|
| gl-inet | ar300m_firmware |
Affected:
4.3.11
cpe:2.3:o:gl-inet:ar300m_firmware:4.3.11:*:*:*:*:*:*:* |
|
| gl-inet | ar300m16_firmware |
Affected:
4.3.11
cpe:2.3:o:gl-inet:ar300m16_firmware:4.3.11:*:*:*:*:*:*:* |
|
| gl-inet | ar750_firmware |
Affected:
4.3.11
cpe:2.3:o:gl-inet:ar750_firmware:4.3.11:*:*:*:*:*:*:* |
|
| gl-inet | ar750s_firmware |
Affected:
4.3.11
cpe:2.3:o:gl-inet:ar750s_firmware:4.3.11:*:*:*:*:*:*:* |
|
| gl-inet | b1300_firmware |
Affected:
4.3.11
cpe:2.3:o:gl-inet:b1300_firmware:4.3.11:*:*:*:*:*:*:* |
|
| gl-inet | mt1300_firmware |
Affected:
4.3.11
cpe:2.3:o:gl-inet:mt1300_firmware:4.3.11:*:*:*:*:*:*:* |
|
| gl-inet | mt300n-v2_firmware |
Affected:
4.3.11
cpe:2.3:o:gl-inet:mt300n-v2_firmware:4.3.11:*:*:*:*:*:*:* |
|
| gl-inet | ap1300_firmware |
Affected:
3.217
cpe:2.3:o:gl-inet:ap1300_firmware:3.217:*:*:*:*:*:*:* |
|
| gl-inet | b2200_firmware |
Affected:
3.216
cpe:2.3:o:gl-inet:b2200_firmware:3.216:*:*:*:*:*:*:* |
|
| gl-inet | mv1000_firmware |
Affected:
3.216
cpe:2.3:o:gl-inet:mv1000_firmware:3.216:*:*:*:*:*:*:* |
|
| gl-inet | mv1000w_firmware |
Affected:
3.216
cpe:2.3:o:gl-inet:mv1000w_firmware:3.216:*:*:*:*:*:*:* |
|
| gl-inet | usb150_firmware |
Affected:
3.216
cpe:2.3:o:gl-inet:usb150_firmware:3.216:*:*:*:*:*:*:* |
|
| gl-inet | sf1200_firmware |
Affected:
3.216
cpe:2.3:o:gl-inet:sf1200_firmware:3.216:*:*:*:*:*:*:* |
|
| gl-inet | n300_firmware |
Affected:
3.216
cpe:2.3:o:gl-inet:n300_firmware:3.216:*:*:*:*:*:*:* |
|
| gl-inet | s1300_firmware |
Affected:
3.216
cpe:2.3:o:gl-inet:s1300_firmware:3.216:*:*:*:*:*:*:* |
|
| gl-inet | gl-mt6000_firmware |
Affected:
4.5.8
cpe:2.3:o:gl-inet:gl-mt6000_firmware:4.5.8:*:*:*:*:*:*:* |
|
| gl-inet | a1300_firmware |
Affected:
4.5.16
cpe:2.3:o:gl-inet:a1300_firmware:4.5.16:*:*:*:*:*:*:* |
|
| gl-inet | x300b_firmware |
Affected:
4.5.16
cpe:2.3:o:gl-inet:x300b_firmware:4.5.16:*:*:*:*:*:*:* |
|
| gl-inet | ax1800_firmware |
Affected:
4.5.16
cpe:2.3:o:gl-inet:ax1800_firmware:4.5.16:*:*:*:*:*:*:* |
|
| gl-inet | mt2500_firmware |
Affected:
4.5.16
cpe:2.3:o:gl-inet:mt2500_firmware:4.5.16:*:*:*:*:*:*:* |
|
| gl-inet | mt3000_firmware |
Affected:
4.5.16
cpe:2.3:o:gl-inet:mt3000_firmware:4.5.16:*:*:*:*:*:*:* |
|
| gl-inet | x3000_firmware |
Affected:
4.4.8
cpe:2.3:o:gl-inet:x3000_firmware:4.4.8:*:*:*:*:*:*:* |
|
| gl-inet | xe300_firmware |
Affected:
4.4.8
cpe:2.3:o:gl-inet:xe300_firmware:4.4.8:*:*:*:*:*:*:* |
|
| gl-inet | xe300_firmware |
Affected:
4.3.16
cpe:2.3:o:gl-inet:xe300_firmware:4.3.16:*:*:*:*:*:*:* |
|
| gl-inet | e750_firmware |
Affected:
4.3.12
cpe:2.3:o:gl-inet:e750_firmware:4.3.12:*:*:*:*:*:*:* |
{
"containers": {
"adp": [
{
"affected": [
{
"cpes": [
"cpe:2.3:o:gl-inet:x750_firmware:4.3.11:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "x750_firmware",
"vendor": "gl-inet",
"versions": [
{
"status": "affected",
"version": "4.3.11"
}
]
},
{
"cpes": [
"cpe:2.3:o:gl-inet:sft1200_firmware:4.3.11:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "sft1200_firmware",
"vendor": "gl-inet",
"versions": [
{
"status": "affected",
"version": "4.3.11"
}
]
},
{
"cpes": [
"cpe:2.3:o:gl-inet:ar300m_firmware:4.3.11:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "ar300m_firmware",
"vendor": "gl-inet",
"versions": [
{
"status": "affected",
"version": "4.3.11"
}
]
},
{
"cpes": [
"cpe:2.3:o:gl-inet:ar300m16_firmware:4.3.11:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "ar300m16_firmware",
"vendor": "gl-inet",
"versions": [
{
"status": "affected",
"version": "4.3.11"
}
]
},
{
"cpes": [
"cpe:2.3:o:gl-inet:ar750_firmware:4.3.11:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "ar750_firmware",
"vendor": "gl-inet",
"versions": [
{
"status": "affected",
"version": "4.3.11"
}
]
},
{
"cpes": [
"cpe:2.3:o:gl-inet:ar750s_firmware:4.3.11:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "ar750s_firmware",
"vendor": "gl-inet",
"versions": [
{
"status": "affected",
"version": "4.3.11"
}
]
},
{
"cpes": [
"cpe:2.3:o:gl-inet:b1300_firmware:4.3.11:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "b1300_firmware",
"vendor": "gl-inet",
"versions": [
{
"status": "affected",
"version": "4.3.11"
}
]
},
{
"cpes": [
"cpe:2.3:o:gl-inet:mt1300_firmware:4.3.11:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "mt1300_firmware",
"vendor": "gl-inet",
"versions": [
{
"status": "affected",
"version": "4.3.11"
}
]
},
{
"cpes": [
"cpe:2.3:o:gl-inet:mt300n-v2_firmware:4.3.11:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "mt300n-v2_firmware",
"vendor": "gl-inet",
"versions": [
{
"status": "affected",
"version": "4.3.11"
}
]
},
{
"cpes": [
"cpe:2.3:o:gl-inet:ap1300_firmware:3.217:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "ap1300_firmware",
"vendor": "gl-inet",
"versions": [
{
"status": "affected",
"version": "3.217"
}
]
},
{
"cpes": [
"cpe:2.3:o:gl-inet:b2200_firmware:3.216:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "b2200_firmware",
"vendor": "gl-inet",
"versions": [
{
"status": "affected",
"version": "3.216"
}
]
},
{
"cpes": [
"cpe:2.3:o:gl-inet:mv1000_firmware:3.216:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "mv1000_firmware",
"vendor": "gl-inet",
"versions": [
{
"status": "affected",
"version": "3.216"
}
]
},
{
"cpes": [
"cpe:2.3:o:gl-inet:mv1000w_firmware:3.216:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "mv1000w_firmware",
"vendor": "gl-inet",
"versions": [
{
"status": "affected",
"version": "3.216"
}
]
},
{
"cpes": [
"cpe:2.3:o:gl-inet:usb150_firmware:3.216:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "usb150_firmware",
"vendor": "gl-inet",
"versions": [
{
"status": "affected",
"version": "3.216"
}
]
},
{
"cpes": [
"cpe:2.3:o:gl-inet:sf1200_firmware:3.216:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "sf1200_firmware",
"vendor": "gl-inet",
"versions": [
{
"status": "affected",
"version": "3.216"
}
]
},
{
"cpes": [
"cpe:2.3:o:gl-inet:n300_firmware:3.216:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "n300_firmware",
"vendor": "gl-inet",
"versions": [
{
"status": "affected",
"version": "3.216"
}
]
},
{
"cpes": [
"cpe:2.3:o:gl-inet:s1300_firmware:3.216:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "s1300_firmware",
"vendor": "gl-inet",
"versions": [
{
"status": "affected",
"version": "3.216"
}
]
},
{
"cpes": [
"cpe:2.3:o:gl-inet:gl-mt6000_firmware:4.5.8:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "gl-mt6000_firmware",
"vendor": "gl-inet",
"versions": [
{
"status": "affected",
"version": "4.5.8"
}
]
},
{
"cpes": [
"cpe:2.3:o:gl-inet:a1300_firmware:4.5.16:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "a1300_firmware",
"vendor": "gl-inet",
"versions": [
{
"status": "affected",
"version": "4.5.16"
}
]
},
{
"cpes": [
"cpe:2.3:o:gl-inet:x300b_firmware:4.5.16:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "x300b_firmware",
"vendor": "gl-inet",
"versions": [
{
"status": "affected",
"version": "4.5.16"
}
]
},
{
"cpes": [
"cpe:2.3:o:gl-inet:ax1800_firmware:4.5.16:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "ax1800_firmware",
"vendor": "gl-inet",
"versions": [
{
"status": "affected",
"version": "4.5.16"
}
]
},
{
"cpes": [
"cpe:2.3:o:gl-inet:mt2500_firmware:4.5.16:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "mt2500_firmware",
"vendor": "gl-inet",
"versions": [
{
"status": "affected",
"version": "4.5.16"
}
]
},
{
"cpes": [
"cpe:2.3:o:gl-inet:mt3000_firmware:4.5.16:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "mt3000_firmware",
"vendor": "gl-inet",
"versions": [
{
"status": "affected",
"version": "4.5.16"
}
]
},
{
"cpes": [
"cpe:2.3:o:gl-inet:x3000_firmware:4.4.8:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "x3000_firmware",
"vendor": "gl-inet",
"versions": [
{
"status": "affected",
"version": "4.4.8"
}
]
},
{
"cpes": [
"cpe:2.3:o:gl-inet:xe300_firmware:4.4.8:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "xe300_firmware",
"vendor": "gl-inet",
"versions": [
{
"status": "affected",
"version": "4.4.8"
}
]
},
{
"cpes": [
"cpe:2.3:o:gl-inet:xe300_firmware:4.3.16:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "xe300_firmware",
"vendor": "gl-inet",
"versions": [
{
"status": "affected",
"version": "4.3.16"
}
]
},
{
"cpes": [
"cpe:2.3:o:gl-inet:e750_firmware:4.3.12:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "e750_firmware",
"vendor": "gl-inet",
"versions": [
{
"status": "affected",
"version": "4.3.12"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2024-39228",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-08-08T14:17:52.681206Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-78",
"description": "CWE-78 Improper Neutralization of Special Elements used in an OS Command (\u0027OS Command Injection\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-08-08T14:46:57.158Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "GL-iNet products AR750/AR750S/AR300M/AR300M16/MT300N-V2/B1300/MT1300/SFT1200/X750 v4.3.11, MT3000/MT2500/AXT1800/AX1800/A1300/X300B v4.5.16, XE300 v4.3.16, E750 v4.3.12, AP1300/S1300 v4.3.13, and XE3000/X3000 v4.4 were discovered to contain a shell injection vulnerability via the interface check_ovpn_client_config and check_config."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-08-15T15:36:52.684Z",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"url": "https://github.com/gl-inet/CVE-issues/blob/main/4.0.0/Ovpn%20interface%20shell%20injection.md"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2024-39228",
"datePublished": "2024-08-06T00:00:00.000Z",
"dateReserved": "2024-06-21T00:00:00.000Z",
"dateUpdated": "2024-08-15T15:36:52.684Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2024-39226 (GCVE-0-2024-39226)
Vulnerability from nvd – Published: 2024-08-06 00:00 – Updated: 2024-11-12 17:08
VLAI
EPSS
VEX
Summary
GL-iNet products AR750/AR750S/AR300M/AR300M16/MT300N-V2/B1300/MT1300/SFT1200/X750 v4.3.11, MT3000/MT2500/AXT1800/AX1800/A1300/X300B v4.5.16, XE300 v4.3.16, E750 v4.3.12, AP1300/S1300 v4.3.13, and XE3000/X3000 v4.4 were discovered to contain a vulnerability can be exploited to manipulate routers by passing malicious shell commands through the s2s API.
Severity
4.3 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2024-08-16 16:17 UTC
CWE
- n/a
- CWE-77 - Improper Neutralization of Special Elements used in a Command ('Command Injection')
Assigner
References
1 reference
{
"containers": {
"adp": [
{
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "ADJACENT_NETWORK",
"availabilityImpact": "LOW",
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2024-39226",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-08-16T16:17:15.444790Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-77",
"description": "CWE-77 Improper Neutralization of Special Elements used in a Command (\u0027Command Injection\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-11-12T17:08:43.264Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "GL-iNet products AR750/AR750S/AR300M/AR300M16/MT300N-V2/B1300/MT1300/SFT1200/X750 v4.3.11, MT3000/MT2500/AXT1800/AX1800/A1300/X300B v4.5.16, XE300 v4.3.16, E750 v4.3.12, AP1300/S1300 v4.3.13, and XE3000/X3000 v4.4 were discovered to contain a vulnerability can be exploited to manipulate routers by passing malicious shell commands through the s2s API."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-08-15T15:44:08.680Z",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"url": "https://github.com/gl-inet/CVE-issues/blob/main/4.0.0/s2s%20interface%20shell%20injection.md"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2024-39226",
"datePublished": "2024-08-06T00:00:00.000Z",
"dateReserved": "2024-06-21T00:00:00.000Z",
"dateUpdated": "2024-11-12T17:08:43.264Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2024-39225 (GCVE-0-2024-39225)
Vulnerability from nvd – Published: 2024-08-06 00:00 – Updated: 2024-08-15 15:31
VLAI
EPSS
VEX
Summary
GL-iNet products AR750/AR750S/AR300M/AR300M16/MT300N-V2/B1300/MT1300/SFT1200/X750 v4.3.11, MT3000/MT2500/AXT1800/AX1800/A1300/X300B v4.5.16, XE300 v4.3.16, E750 v4.3.12, AP1300/S1300 v4.3.13, and XE3000/X3000 v4.4 were discovered to contain a remote code execution (RCE) vulnerability.
Severity
9.8 (Critical)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2024-08-08 14:48 UTC
CWE
- n/a
- CWE-307 - Improper Restriction of Excessive Authentication Attempts
Assigner
References
1 reference
Impacted products
28 products
| Vendor | Product | Version | |
|---|---|---|---|
| gl-inet | mt6000_firmware |
Affected:
4.5.8
cpe:2.3:o:gl-inet:mt6000_firmware:4.5.8:*:*:*:*:*:*:* |
|
| gl-inet | a1300_firmware |
Affected:
4.5.16
cpe:2.3:o:gl-inet:a1300_firmware:4.5.16:*:*:*:*:*:*:* |
|
| gl-inet | x300b_firmware |
Affected:
4.5.16
cpe:2.3:o:gl-inet:x300b_firmware:4.5.16:*:*:*:*:*:*:* |
|
| gl-inet | ax1800_firmware |
Affected:
4.5.16
cpe:2.3:o:gl-inet:ax1800_firmware:4.5.16:*:*:*:*:*:*:* |
|
| gl-inet | axt1800_firmware |
Affected:
4.5.16
cpe:2.3:o:gl-inet:axt1800_firmware:4.5.16:*:*:*:*:*:*:* |
|
| gl-inet | mt2500_firmware |
Affected:
4.5.16
cpe:2.3:o:gl-inet:mt2500_firmware:4.5.16:*:*:*:*:*:*:* |
|
| gl-inet | mt3000_firmware |
Affected:
4.5.16
cpe:2.3:o:gl-inet:mt3000_firmware:4.5.16:*:*:*:*:*:*:* |
|
| gl-inet | x3000_firmware |
Affected:
4.4.8
cpe:2.3:o:gl-inet:x3000_firmware:4.4.8:*:*:*:*:*:*:* |
|
| gl-inet | xe3000_firmware |
Affected:
4.4.8
cpe:2.3:o:gl-inet:xe3000_firmware:4.4.8:*:*:*:*:*:*:* |
|
| gl-inet | xe300_firmware |
Affected:
4.3.16
cpe:2.3:o:gl-inet:xe300_firmware:4.3.16:*:*:*:*:*:*:* |
|
| gl-inet | e750_firmware |
Affected:
4.3.12
cpe:2.3:o:gl-inet:e750_firmware:4.3.12:*:*:*:*:*:*:* |
|
| gl-inet | x750_firmware |
Affected:
4.3.11
cpe:2.3:o:gl-inet:x750_firmware:4.3.11:*:*:*:*:*:*:* |
|
| gl-inet | sft1200_firmware |
Affected:
4.3.11
cpe:2.3:o:gl-inet:sft1200_firmware:4.3.11:*:*:*:*:*:*:* |
|
| gl-inet | ar300m_firmware |
Affected:
4.3.11
cpe:2.3:o:gl-inet:ar300m_firmware:4.3.11:*:*:*:*:*:*:* |
|
| gl-inet | ar300m16_firmware |
Affected:
4.3.11
cpe:2.3:o:gl-inet:ar300m16_firmware:4.3.11:*:*:*:*:*:*:* |
|
| gl-inet | ar750_firmware |
Affected:
4.3.11
cpe:2.3:o:gl-inet:ar750_firmware:4.3.11:*:*:*:*:*:*:* |
|
| gl-inet | ar750s_firmware |
Affected:
4.3.11
cpe:2.3:o:gl-inet:ar750s_firmware:4.3.11:*:*:*:*:*:*:* |
|
| gl-inet | b1300_firmware |
Affected:
4.3.11
cpe:2.3:o:gl-inet:b1300_firmware:4.3.11:*:*:*:*:*:*:* |
|
| gl-inet | mt1300_firmware |
Affected:
4.3.11
cpe:2.3:o:gl-inet:mt1300_firmware:4.3.11:*:*:*:*:*:*:* |
|
| gl-inet | mt300n-v2_firmware |
Affected:
4.3.11
cpe:2.3:o:gl-inet:mt300n-v2_firmware:4.3.11:*:*:*:*:*:*:* |
|
| gl-inet | ap1300_firmware |
Affected:
3.217
cpe:2.3:o:gl-inet:ap1300_firmware:3.217:*:*:*:*:*:*:* |
|
| gl-inet | b2200_firmware |
Affected:
3.216
cpe:2.3:o:gl-inet:b2200_firmware:3.216:*:*:*:*:*:*:* |
|
| gl-inet | mv1000_firmware |
Affected:
3.216
cpe:2.3:o:gl-inet:mv1000_firmware:3.216:*:*:*:*:*:*:* |
|
| gl-inet | mv1000w_firmware |
Affected:
3.216
cpe:2.3:o:gl-inet:mv1000w_firmware:3.216:*:*:*:*:*:*:* |
|
| gl-inet | usb150_firmware |
Affected:
3.216
cpe:2.3:o:gl-inet:usb150_firmware:3.216:*:*:*:*:*:*:* |
|
| gl-inet | sf1200_firmware |
Affected:
3.216
cpe:2.3:o:gl-inet:sf1200_firmware:3.216:*:*:*:*:*:*:* |
|
| gl-inet | n300_firmware |
Affected:
3.216
cpe:2.3:o:gl-inet:n300_firmware:3.216:*:*:*:*:*:*:* |
|
| gl-inet | s1300_firmware |
Affected:
3.216
cpe:2.3:o:gl-inet:s1300_firmware:3.216:*:*:*:*:*:*:* |
{
"containers": {
"adp": [
{
"affected": [
{
"cpes": [
"cpe:2.3:o:gl-inet:mt6000_firmware:4.5.8:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "mt6000_firmware",
"vendor": "gl-inet",
"versions": [
{
"status": "affected",
"version": "4.5.8"
}
]
},
{
"cpes": [
"cpe:2.3:o:gl-inet:a1300_firmware:4.5.16:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "a1300_firmware",
"vendor": "gl-inet",
"versions": [
{
"status": "affected",
"version": "4.5.16"
}
]
},
{
"cpes": [
"cpe:2.3:o:gl-inet:x300b_firmware:4.5.16:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "x300b_firmware",
"vendor": "gl-inet",
"versions": [
{
"status": "affected",
"version": "4.5.16"
}
]
},
{
"cpes": [
"cpe:2.3:o:gl-inet:ax1800_firmware:4.5.16:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "ax1800_firmware",
"vendor": "gl-inet",
"versions": [
{
"status": "affected",
"version": "4.5.16"
}
]
},
{
"cpes": [
"cpe:2.3:o:gl-inet:axt1800_firmware:4.5.16:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "axt1800_firmware",
"vendor": "gl-inet",
"versions": [
{
"status": "affected",
"version": "4.5.16"
}
]
},
{
"cpes": [
"cpe:2.3:o:gl-inet:mt2500_firmware:4.5.16:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "mt2500_firmware",
"vendor": "gl-inet",
"versions": [
{
"status": "affected",
"version": "4.5.16"
}
]
},
{
"cpes": [
"cpe:2.3:o:gl-inet:mt3000_firmware:4.5.16:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "mt3000_firmware",
"vendor": "gl-inet",
"versions": [
{
"status": "affected",
"version": "4.5.16"
}
]
},
{
"cpes": [
"cpe:2.3:o:gl-inet:x3000_firmware:4.4.8:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "x3000_firmware",
"vendor": "gl-inet",
"versions": [
{
"status": "affected",
"version": "4.4.8"
}
]
},
{
"cpes": [
"cpe:2.3:o:gl-inet:xe3000_firmware:4.4.8:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "xe3000_firmware",
"vendor": "gl-inet",
"versions": [
{
"status": "affected",
"version": "4.4.8"
}
]
},
{
"cpes": [
"cpe:2.3:o:gl-inet:xe300_firmware:4.3.16:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "xe300_firmware",
"vendor": "gl-inet",
"versions": [
{
"status": "affected",
"version": "4.3.16"
}
]
},
{
"cpes": [
"cpe:2.3:o:gl-inet:e750_firmware:4.3.12:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "e750_firmware",
"vendor": "gl-inet",
"versions": [
{
"status": "affected",
"version": "4.3.12"
}
]
},
{
"cpes": [
"cpe:2.3:o:gl-inet:x750_firmware:4.3.11:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "x750_firmware",
"vendor": "gl-inet",
"versions": [
{
"status": "affected",
"version": "4.3.11"
}
]
},
{
"cpes": [
"cpe:2.3:o:gl-inet:sft1200_firmware:4.3.11:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "sft1200_firmware",
"vendor": "gl-inet",
"versions": [
{
"status": "affected",
"version": "4.3.11"
}
]
},
{
"cpes": [
"cpe:2.3:o:gl-inet:ar300m_firmware:4.3.11:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "ar300m_firmware",
"vendor": "gl-inet",
"versions": [
{
"status": "affected",
"version": "4.3.11"
}
]
},
{
"cpes": [
"cpe:2.3:o:gl-inet:ar300m16_firmware:4.3.11:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "ar300m16_firmware",
"vendor": "gl-inet",
"versions": [
{
"status": "affected",
"version": "4.3.11"
}
]
},
{
"cpes": [
"cpe:2.3:o:gl-inet:ar750_firmware:4.3.11:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "ar750_firmware",
"vendor": "gl-inet",
"versions": [
{
"status": "affected",
"version": "4.3.11"
}
]
},
{
"cpes": [
"cpe:2.3:o:gl-inet:ar750s_firmware:4.3.11:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "ar750s_firmware",
"vendor": "gl-inet",
"versions": [
{
"status": "affected",
"version": "4.3.11"
}
]
},
{
"cpes": [
"cpe:2.3:o:gl-inet:b1300_firmware:4.3.11:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "b1300_firmware",
"vendor": "gl-inet",
"versions": [
{
"status": "affected",
"version": "4.3.11"
}
]
},
{
"cpes": [
"cpe:2.3:o:gl-inet:mt1300_firmware:4.3.11:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "mt1300_firmware",
"vendor": "gl-inet",
"versions": [
{
"status": "affected",
"version": "4.3.11"
}
]
},
{
"cpes": [
"cpe:2.3:o:gl-inet:mt300n-v2_firmware:4.3.11:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "mt300n-v2_firmware",
"vendor": "gl-inet",
"versions": [
{
"status": "affected",
"version": "4.3.11"
}
]
},
{
"cpes": [
"cpe:2.3:o:gl-inet:ap1300_firmware:3.217:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "ap1300_firmware",
"vendor": "gl-inet",
"versions": [
{
"status": "affected",
"version": "3.217"
}
]
},
{
"cpes": [
"cpe:2.3:o:gl-inet:b2200_firmware:3.216:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "b2200_firmware",
"vendor": "gl-inet",
"versions": [
{
"status": "affected",
"version": "3.216"
}
]
},
{
"cpes": [
"cpe:2.3:o:gl-inet:mv1000_firmware:3.216:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "mv1000_firmware",
"vendor": "gl-inet",
"versions": [
{
"status": "affected",
"version": "3.216"
}
]
},
{
"cpes": [
"cpe:2.3:o:gl-inet:mv1000w_firmware:3.216:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "mv1000w_firmware",
"vendor": "gl-inet",
"versions": [
{
"status": "affected",
"version": "3.216"
}
]
},
{
"cpes": [
"cpe:2.3:o:gl-inet:usb150_firmware:3.216:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "usb150_firmware",
"vendor": "gl-inet",
"versions": [
{
"status": "affected",
"version": "3.216"
}
]
},
{
"cpes": [
"cpe:2.3:o:gl-inet:sf1200_firmware:3.216:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "sf1200_firmware",
"vendor": "gl-inet",
"versions": [
{
"status": "affected",
"version": "3.216"
}
]
},
{
"cpes": [
"cpe:2.3:o:gl-inet:n300_firmware:3.216:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "n300_firmware",
"vendor": "gl-inet",
"versions": [
{
"status": "affected",
"version": "3.216"
}
]
},
{
"cpes": [
"cpe:2.3:o:gl-inet:s1300_firmware:3.216:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "s1300_firmware",
"vendor": "gl-inet",
"versions": [
{
"status": "affected",
"version": "3.216"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2024-39225",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-08-08T14:48:57.143782Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-307",
"description": "CWE-307 Improper Restriction of Excessive Authentication Attempts",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-08-08T15:09:56.428Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "GL-iNet products AR750/AR750S/AR300M/AR300M16/MT300N-V2/B1300/MT1300/SFT1200/X750 v4.3.11, MT3000/MT2500/AXT1800/AX1800/A1300/X300B v4.5.16, XE300 v4.3.16, E750 v4.3.12, AP1300/S1300 v4.3.13, and XE3000/X3000 v4.4 were discovered to contain a remote code execution (RCE) vulnerability."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-08-15T15:31:54.275Z",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"url": "https://github.com/gl-inet/CVE-issues/blob/main/4.0.0/Bypass%20the%20login%20mechanism.md"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2024-39225",
"datePublished": "2024-08-06T00:00:00.000Z",
"dateReserved": "2024-06-21T00:00:00.000Z",
"dateUpdated": "2024-08-15T15:31:54.275Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2024-27356 (GCVE-0-2024-27356)
Vulnerability from nvd – Published: 2024-02-27 00:00 – Updated: 2025-03-24 15:44
VLAI
EPSS
VEX
Summary
An issue was discovered on certain GL-iNet devices. Attackers can download files such as logs via commands, potentially obtaining critical user information. This affects MT6000 4.5.5, XE3000 4.4.4, X3000 4.4.5, MT3000 4.5.0, MT2500 4.5.0, AXT1800 4.5.0, AX1800 4.5.0, A1300 4.5.0, S200 4.1.4-0300, X750 4.3.7, SFT1200 4.3.7, XE300 4.3.7, MT1300 4.3.10, AR750 4.3.10, AR750S 4.3.10, AR300M 4.3.10, AR300M16 4.3.10, B1300 4.3.10, MT300N-v2 4.3.10, X300B 3.217, S1300 3.216, SF1200 3.216, MV1000 3.216, N300 3.216, B2200 3.216, and X1200 3.203.
Severity
7.5 (High)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2024-02-27 15:51 UTC
CWE
- n/a
- CWE-200 - Exposure of Sensitive Information to an Unauthorized Actor
Assigner
References
2 references
Impacted products
27 products
| Vendor | Product | Version | |
|---|---|---|---|
| gl-inet | mt1300 |
Affected:
4.3.10
cpe:2.3:a:gl-inet:mt1300:4.3.10:*:*:*:*:*:*:* |
|
| gl-inet | ar750 |
Affected:
4.3.10
cpe:2.3:a:gl-inet:ar750:4.3.10:*:*:*:*:*:*:* |
|
| gl-inet | ar750s |
Affected:
4.3.10
cpe:2.3:a:gl-inet:ar750s:4.3.10:*:*:*:*:*:*:* |
|
| gl.inet | MT6000 |
Affected:
4.5.5
cpe:2.3:h:gl.inet:MT6000:-:*:*:*:*:*:*:* |
|
| gl-inet | xe3000 |
Affected:
4.4.4
cpe:2.3:a:gl-inet:xe3000:4.4.4:*:*:*:*:*:*:* |
|
| gl-inet | x3000 |
Affected:
4.4.5
cpe:2.3:a:gl-inet:x3000:4.4.5:*:*:*:*:*:*:* |
|
| gl-inet | mt3000 |
Affected:
4.5.0
cpe:2.3:a:gl-inet:mt3000:4.5.0:*:*:*:*:*:*:* |
|
| gl-inet | mt2500 |
Affected:
4.5.0
cpe:2.3:a:gl-inet:mt2500:4.5.0:*:*:*:*:*:*:* |
|
| gl-inet | axt1800 |
Affected:
4.5.0
cpe:2.3:a:gl-inet:axt1800:4.5.0:*:*:*:*:*:*:* |
|
| gl-inet | ax1800 |
Affected:
4.5.0
cpe:2.3:a:gl-inet:ax1800:4.5.0:*:*:*:*:*:*:* |
|
| gl-inet | a1300 |
Affected:
4.5.0
cpe:2.3:a:gl-inet:a1300:4.5.0:*:*:*:*:*:*:* |
|
| gl-inet | s200 |
Affected:
4.1.4
cpe:2.3:a:gl-inet:s200:4.1.4:*:*:*:*:*:*:* |
|
| gl-inet | 0300 |
Affected:
4.3.7
cpe:2.3:a:gl-inet:0300:*:*:*:*:*:*:*:* |
|
| gl-inet | x750 |
Affected:
4.3.7
cpe:2.3:a:gl-inet:x750:4.3.7:*:*:*:*:*:*:* |
|
| gl-inet | sft1200 |
Affected:
4.3.7
cpe:2.3:a:gl-inet:sft1200:4.3.7:*:*:*:*:*:*:* |
|
| gl-inet | xe300 |
Affected:
4.3.7
cpe:2.3:a:gl-inet:xe300:4.3.7:*:*:*:*:*:*:* |
|
| gl-inet | ar3000m |
Affected:
4.3.10
cpe:2.3:a:gl-inet:ar3000m:4.3.10:*:*:*:*:*:*:* |
|
| gl-inet | ar3000m16 |
Affected:
4.3.10
cpe:2.3:a:gl-inet:ar3000m16:4.3.10:*:*:*:*:*:*:* |
|
| gl-inet | b1300 |
Affected:
4.3.10
cpe:2.3:a:gl-inet:b1300:4.3.10:*:*:*:*:*:*:* |
|
| gl-inet | mt300nv2 |
Affected:
4.3.10
cpe:2.3:a:gl-inet:mt300nv2:4.3.10:*:*:*:*:*:*:* |
|
| gl-inet | x300b |
Affected:
3.217
cpe:2.3:a:gl-inet:x300b:3.217:*:*:*:*:*:*:* |
|
| gl-inet | s1300 |
Affected:
3.216
cpe:2.3:a:gl-inet:s1300:3.216:*:*:*:*:*:*:* |
|
| gl-inet | sf1200 |
Affected:
3.216
cpe:2.3:a:gl-inet:sf1200:3.216:*:*:*:*:*:*:* |
|
| gl-inet | mv1000 |
Affected:
3.216
cpe:2.3:a:gl-inet:mv1000:3.216:*:*:*:*:*:*:* |
|
| gl-inet | n300 |
Affected:
3.216
cpe:2.3:a:gl-inet:n300:3.216:*:*:*:*:*:*:* |
|
| gl-inet | b2200 |
Affected:
3.216
cpe:2.3:a:gl-inet:b2200:3.216:*:*:*:*:*:*:* |
|
| gl-i | x1200 |
Affected:
3.203
cpe:2.3:a:gl-i:x1200:3.203:*:*:*:*:*:*:* |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-02T00:34:51.986Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_transferred"
],
"url": "https://gl-inet.com"
},
{
"tags": [
"x_transferred"
],
"url": "https://github.com/gl-inet/CVE-issues/blob/main/4.0.0/Download_file_vulnerability.md"
}
],
"title": "CVE Program Container"
},
{
"affected": [
{
"cpes": [
"cpe:2.3:a:gl-inet:mt1300:4.3.10:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "mt1300",
"vendor": "gl-inet",
"versions": [
{
"status": "affected",
"version": "4.3.10"
}
]
},
{
"cpes": [
"cpe:2.3:a:gl-inet:ar750:4.3.10:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "ar750",
"vendor": "gl-inet",
"versions": [
{
"status": "affected",
"version": "4.3.10"
}
]
},
{
"cpes": [
"cpe:2.3:a:gl-inet:ar750s:4.3.10:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "ar750s",
"vendor": "gl-inet",
"versions": [
{
"status": "affected",
"version": "4.3.10"
}
]
},
{
"cpes": [
"cpe:2.3:h:gl.inet:MT6000:-:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "MT6000",
"vendor": "gl.inet",
"versions": [
{
"status": "affected",
"version": "4.5.5"
}
]
},
{
"cpes": [
"cpe:2.3:a:gl-inet:xe3000:4.4.4:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "xe3000",
"vendor": "gl-inet",
"versions": [
{
"status": "affected",
"version": "4.4.4"
}
]
},
{
"cpes": [
"cpe:2.3:a:gl-inet:x3000:4.4.5:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "x3000",
"vendor": "gl-inet",
"versions": [
{
"status": "affected",
"version": "4.4.5"
}
]
},
{
"cpes": [
"cpe:2.3:a:gl-inet:mt3000:4.5.0:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "mt3000",
"vendor": "gl-inet",
"versions": [
{
"status": "affected",
"version": "4.5.0"
}
]
},
{
"cpes": [
"cpe:2.3:a:gl-inet:mt2500:4.5.0:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "mt2500",
"vendor": "gl-inet",
"versions": [
{
"status": "affected",
"version": "4.5.0"
}
]
},
{
"cpes": [
"cpe:2.3:a:gl-inet:axt1800:4.5.0:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "axt1800",
"vendor": "gl-inet",
"versions": [
{
"status": "affected",
"version": "4.5.0"
}
]
},
{
"cpes": [
"cpe:2.3:a:gl-inet:ax1800:4.5.0:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "ax1800",
"vendor": "gl-inet",
"versions": [
{
"status": "affected",
"version": "4.5.0"
}
]
},
{
"cpes": [
"cpe:2.3:a:gl-inet:a1300:4.5.0:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "a1300",
"vendor": "gl-inet",
"versions": [
{
"status": "affected",
"version": "4.5.0"
}
]
},
{
"cpes": [
"cpe:2.3:a:gl-inet:s200:4.1.4:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "s200",
"vendor": "gl-inet",
"versions": [
{
"status": "affected",
"version": "4.1.4"
}
]
},
{
"cpes": [
"cpe:2.3:a:gl-inet:0300:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "0300",
"vendor": "gl-inet",
"versions": [
{
"status": "affected",
"version": "4.3.7"
}
]
},
{
"cpes": [
"cpe:2.3:a:gl-inet:x750:4.3.7:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "x750",
"vendor": "gl-inet",
"versions": [
{
"status": "affected",
"version": "4.3.7"
}
]
},
{
"cpes": [
"cpe:2.3:a:gl-inet:sft1200:4.3.7:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "sft1200",
"vendor": "gl-inet",
"versions": [
{
"status": "affected",
"version": "4.3.7"
}
]
},
{
"cpes": [
"cpe:2.3:a:gl-inet:xe300:4.3.7:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "xe300",
"vendor": "gl-inet",
"versions": [
{
"status": "affected",
"version": "4.3.7"
}
]
},
{
"cpes": [
"cpe:2.3:a:gl-inet:ar3000m:4.3.10:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "ar3000m",
"vendor": "gl-inet",
"versions": [
{
"status": "affected",
"version": "4.3.10"
}
]
},
{
"cpes": [
"cpe:2.3:a:gl-inet:ar3000m16:4.3.10:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "ar3000m16",
"vendor": "gl-inet",
"versions": [
{
"status": "affected",
"version": "4.3.10"
}
]
},
{
"cpes": [
"cpe:2.3:a:gl-inet:b1300:4.3.10:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "b1300",
"vendor": "gl-inet",
"versions": [
{
"status": "affected",
"version": "4.3.10"
}
]
},
{
"cpes": [
"cpe:2.3:a:gl-inet:mt300nv2:4.3.10:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "mt300nv2",
"vendor": "gl-inet",
"versions": [
{
"status": "affected",
"version": "4.3.10"
}
]
},
{
"cpes": [
"cpe:2.3:a:gl-inet:x300b:3.217:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "x300b",
"vendor": "gl-inet",
"versions": [
{
"status": "affected",
"version": "3.217"
}
]
},
{
"cpes": [
"cpe:2.3:a:gl-inet:s1300:3.216:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "s1300",
"vendor": "gl-inet",
"versions": [
{
"status": "affected",
"version": "3.216"
}
]
},
{
"cpes": [
"cpe:2.3:a:gl-inet:sf1200:3.216:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "sf1200",
"vendor": "gl-inet",
"versions": [
{
"status": "affected",
"version": "3.216"
}
]
},
{
"cpes": [
"cpe:2.3:a:gl-inet:mv1000:3.216:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "mv1000",
"vendor": "gl-inet",
"versions": [
{
"status": "affected",
"version": "3.216"
}
]
},
{
"cpes": [
"cpe:2.3:a:gl-inet:n300:3.216:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "n300",
"vendor": "gl-inet",
"versions": [
{
"status": "affected",
"version": "3.216"
}
]
},
{
"cpes": [
"cpe:2.3:a:gl-inet:b2200:3.216:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "b2200",
"vendor": "gl-inet",
"versions": [
{
"status": "affected",
"version": "3.216"
}
]
},
{
"cpes": [
"cpe:2.3:a:gl-i:x1200:3.203:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "x1200",
"vendor": "gl-i",
"versions": [
{
"status": "affected",
"version": "3.203"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2024-27356",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-02-27T15:51:15.040940Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-200",
"description": "CWE-200 Exposure of Sensitive Information to an Unauthorized Actor",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-03-24T15:44:54.024Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "An issue was discovered on certain GL-iNet devices. Attackers can download files such as logs via commands, potentially obtaining critical user information. This affects MT6000 4.5.5, XE3000 4.4.4, X3000 4.4.5, MT3000 4.5.0, MT2500 4.5.0, AXT1800 4.5.0, AX1800 4.5.0, A1300 4.5.0, S200 4.1.4-0300, X750 4.3.7, SFT1200 4.3.7, XE300 4.3.7, MT1300 4.3.10, AR750 4.3.10, AR750S 4.3.10, AR300M 4.3.10, AR300M16 4.3.10, B1300 4.3.10, MT300N-v2 4.3.10, X300B 3.217, S1300 3.216, SF1200 3.216, MV1000 3.216, N300 3.216, B2200 3.216, and X1200 3.203."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-02-27T00:17:16.406Z",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"url": "https://gl-inet.com"
},
{
"url": "https://github.com/gl-inet/CVE-issues/blob/main/4.0.0/Download_file_vulnerability.md"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2024-27356",
"datePublished": "2024-02-27T00:00:00.000Z",
"dateReserved": "2024-02-25T00:00:00.000Z",
"dateUpdated": "2025-03-24T15:44:54.024Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2024-39228 (GCVE-0-2024-39228)
Vulnerability from cvelistv5 – Published: 2024-08-06 00:00 – Updated: 2024-08-15 15:36
VLAI
EPSS
VEX
Summary
GL-iNet products AR750/AR750S/AR300M/AR300M16/MT300N-V2/B1300/MT1300/SFT1200/X750 v4.3.11, MT3000/MT2500/AXT1800/AX1800/A1300/X300B v4.5.16, XE300 v4.3.16, E750 v4.3.12, AP1300/S1300 v4.3.13, and XE3000/X3000 v4.4 were discovered to contain a shell injection vulnerability via the interface check_ovpn_client_config and check_config.
Severity
9.8 (Critical)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2024-08-08 14:17 UTC
CWE
- n/a
- CWE-78 - Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Assigner
References
1 reference
Impacted products
27 products
| Vendor | Product | Version | |
|---|---|---|---|
| gl-inet | x750_firmware |
Affected:
4.3.11
cpe:2.3:o:gl-inet:x750_firmware:4.3.11:*:*:*:*:*:*:* |
|
| gl-inet | sft1200_firmware |
Affected:
4.3.11
cpe:2.3:o:gl-inet:sft1200_firmware:4.3.11:*:*:*:*:*:*:* |
|
| gl-inet | ar300m_firmware |
Affected:
4.3.11
cpe:2.3:o:gl-inet:ar300m_firmware:4.3.11:*:*:*:*:*:*:* |
|
| gl-inet | ar300m16_firmware |
Affected:
4.3.11
cpe:2.3:o:gl-inet:ar300m16_firmware:4.3.11:*:*:*:*:*:*:* |
|
| gl-inet | ar750_firmware |
Affected:
4.3.11
cpe:2.3:o:gl-inet:ar750_firmware:4.3.11:*:*:*:*:*:*:* |
|
| gl-inet | ar750s_firmware |
Affected:
4.3.11
cpe:2.3:o:gl-inet:ar750s_firmware:4.3.11:*:*:*:*:*:*:* |
|
| gl-inet | b1300_firmware |
Affected:
4.3.11
cpe:2.3:o:gl-inet:b1300_firmware:4.3.11:*:*:*:*:*:*:* |
|
| gl-inet | mt1300_firmware |
Affected:
4.3.11
cpe:2.3:o:gl-inet:mt1300_firmware:4.3.11:*:*:*:*:*:*:* |
|
| gl-inet | mt300n-v2_firmware |
Affected:
4.3.11
cpe:2.3:o:gl-inet:mt300n-v2_firmware:4.3.11:*:*:*:*:*:*:* |
|
| gl-inet | ap1300_firmware |
Affected:
3.217
cpe:2.3:o:gl-inet:ap1300_firmware:3.217:*:*:*:*:*:*:* |
|
| gl-inet | b2200_firmware |
Affected:
3.216
cpe:2.3:o:gl-inet:b2200_firmware:3.216:*:*:*:*:*:*:* |
|
| gl-inet | mv1000_firmware |
Affected:
3.216
cpe:2.3:o:gl-inet:mv1000_firmware:3.216:*:*:*:*:*:*:* |
|
| gl-inet | mv1000w_firmware |
Affected:
3.216
cpe:2.3:o:gl-inet:mv1000w_firmware:3.216:*:*:*:*:*:*:* |
|
| gl-inet | usb150_firmware |
Affected:
3.216
cpe:2.3:o:gl-inet:usb150_firmware:3.216:*:*:*:*:*:*:* |
|
| gl-inet | sf1200_firmware |
Affected:
3.216
cpe:2.3:o:gl-inet:sf1200_firmware:3.216:*:*:*:*:*:*:* |
|
| gl-inet | n300_firmware |
Affected:
3.216
cpe:2.3:o:gl-inet:n300_firmware:3.216:*:*:*:*:*:*:* |
|
| gl-inet | s1300_firmware |
Affected:
3.216
cpe:2.3:o:gl-inet:s1300_firmware:3.216:*:*:*:*:*:*:* |
|
| gl-inet | gl-mt6000_firmware |
Affected:
4.5.8
cpe:2.3:o:gl-inet:gl-mt6000_firmware:4.5.8:*:*:*:*:*:*:* |
|
| gl-inet | a1300_firmware |
Affected:
4.5.16
cpe:2.3:o:gl-inet:a1300_firmware:4.5.16:*:*:*:*:*:*:* |
|
| gl-inet | x300b_firmware |
Affected:
4.5.16
cpe:2.3:o:gl-inet:x300b_firmware:4.5.16:*:*:*:*:*:*:* |
|
| gl-inet | ax1800_firmware |
Affected:
4.5.16
cpe:2.3:o:gl-inet:ax1800_firmware:4.5.16:*:*:*:*:*:*:* |
|
| gl-inet | mt2500_firmware |
Affected:
4.5.16
cpe:2.3:o:gl-inet:mt2500_firmware:4.5.16:*:*:*:*:*:*:* |
|
| gl-inet | mt3000_firmware |
Affected:
4.5.16
cpe:2.3:o:gl-inet:mt3000_firmware:4.5.16:*:*:*:*:*:*:* |
|
| gl-inet | x3000_firmware |
Affected:
4.4.8
cpe:2.3:o:gl-inet:x3000_firmware:4.4.8:*:*:*:*:*:*:* |
|
| gl-inet | xe300_firmware |
Affected:
4.4.8
cpe:2.3:o:gl-inet:xe300_firmware:4.4.8:*:*:*:*:*:*:* |
|
| gl-inet | xe300_firmware |
Affected:
4.3.16
cpe:2.3:o:gl-inet:xe300_firmware:4.3.16:*:*:*:*:*:*:* |
|
| gl-inet | e750_firmware |
Affected:
4.3.12
cpe:2.3:o:gl-inet:e750_firmware:4.3.12:*:*:*:*:*:*:* |
{
"containers": {
"adp": [
{
"affected": [
{
"cpes": [
"cpe:2.3:o:gl-inet:x750_firmware:4.3.11:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "x750_firmware",
"vendor": "gl-inet",
"versions": [
{
"status": "affected",
"version": "4.3.11"
}
]
},
{
"cpes": [
"cpe:2.3:o:gl-inet:sft1200_firmware:4.3.11:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "sft1200_firmware",
"vendor": "gl-inet",
"versions": [
{
"status": "affected",
"version": "4.3.11"
}
]
},
{
"cpes": [
"cpe:2.3:o:gl-inet:ar300m_firmware:4.3.11:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "ar300m_firmware",
"vendor": "gl-inet",
"versions": [
{
"status": "affected",
"version": "4.3.11"
}
]
},
{
"cpes": [
"cpe:2.3:o:gl-inet:ar300m16_firmware:4.3.11:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "ar300m16_firmware",
"vendor": "gl-inet",
"versions": [
{
"status": "affected",
"version": "4.3.11"
}
]
},
{
"cpes": [
"cpe:2.3:o:gl-inet:ar750_firmware:4.3.11:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "ar750_firmware",
"vendor": "gl-inet",
"versions": [
{
"status": "affected",
"version": "4.3.11"
}
]
},
{
"cpes": [
"cpe:2.3:o:gl-inet:ar750s_firmware:4.3.11:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "ar750s_firmware",
"vendor": "gl-inet",
"versions": [
{
"status": "affected",
"version": "4.3.11"
}
]
},
{
"cpes": [
"cpe:2.3:o:gl-inet:b1300_firmware:4.3.11:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "b1300_firmware",
"vendor": "gl-inet",
"versions": [
{
"status": "affected",
"version": "4.3.11"
}
]
},
{
"cpes": [
"cpe:2.3:o:gl-inet:mt1300_firmware:4.3.11:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "mt1300_firmware",
"vendor": "gl-inet",
"versions": [
{
"status": "affected",
"version": "4.3.11"
}
]
},
{
"cpes": [
"cpe:2.3:o:gl-inet:mt300n-v2_firmware:4.3.11:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "mt300n-v2_firmware",
"vendor": "gl-inet",
"versions": [
{
"status": "affected",
"version": "4.3.11"
}
]
},
{
"cpes": [
"cpe:2.3:o:gl-inet:ap1300_firmware:3.217:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "ap1300_firmware",
"vendor": "gl-inet",
"versions": [
{
"status": "affected",
"version": "3.217"
}
]
},
{
"cpes": [
"cpe:2.3:o:gl-inet:b2200_firmware:3.216:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "b2200_firmware",
"vendor": "gl-inet",
"versions": [
{
"status": "affected",
"version": "3.216"
}
]
},
{
"cpes": [
"cpe:2.3:o:gl-inet:mv1000_firmware:3.216:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "mv1000_firmware",
"vendor": "gl-inet",
"versions": [
{
"status": "affected",
"version": "3.216"
}
]
},
{
"cpes": [
"cpe:2.3:o:gl-inet:mv1000w_firmware:3.216:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "mv1000w_firmware",
"vendor": "gl-inet",
"versions": [
{
"status": "affected",
"version": "3.216"
}
]
},
{
"cpes": [
"cpe:2.3:o:gl-inet:usb150_firmware:3.216:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "usb150_firmware",
"vendor": "gl-inet",
"versions": [
{
"status": "affected",
"version": "3.216"
}
]
},
{
"cpes": [
"cpe:2.3:o:gl-inet:sf1200_firmware:3.216:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "sf1200_firmware",
"vendor": "gl-inet",
"versions": [
{
"status": "affected",
"version": "3.216"
}
]
},
{
"cpes": [
"cpe:2.3:o:gl-inet:n300_firmware:3.216:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "n300_firmware",
"vendor": "gl-inet",
"versions": [
{
"status": "affected",
"version": "3.216"
}
]
},
{
"cpes": [
"cpe:2.3:o:gl-inet:s1300_firmware:3.216:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "s1300_firmware",
"vendor": "gl-inet",
"versions": [
{
"status": "affected",
"version": "3.216"
}
]
},
{
"cpes": [
"cpe:2.3:o:gl-inet:gl-mt6000_firmware:4.5.8:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "gl-mt6000_firmware",
"vendor": "gl-inet",
"versions": [
{
"status": "affected",
"version": "4.5.8"
}
]
},
{
"cpes": [
"cpe:2.3:o:gl-inet:a1300_firmware:4.5.16:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "a1300_firmware",
"vendor": "gl-inet",
"versions": [
{
"status": "affected",
"version": "4.5.16"
}
]
},
{
"cpes": [
"cpe:2.3:o:gl-inet:x300b_firmware:4.5.16:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "x300b_firmware",
"vendor": "gl-inet",
"versions": [
{
"status": "affected",
"version": "4.5.16"
}
]
},
{
"cpes": [
"cpe:2.3:o:gl-inet:ax1800_firmware:4.5.16:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "ax1800_firmware",
"vendor": "gl-inet",
"versions": [
{
"status": "affected",
"version": "4.5.16"
}
]
},
{
"cpes": [
"cpe:2.3:o:gl-inet:mt2500_firmware:4.5.16:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "mt2500_firmware",
"vendor": "gl-inet",
"versions": [
{
"status": "affected",
"version": "4.5.16"
}
]
},
{
"cpes": [
"cpe:2.3:o:gl-inet:mt3000_firmware:4.5.16:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "mt3000_firmware",
"vendor": "gl-inet",
"versions": [
{
"status": "affected",
"version": "4.5.16"
}
]
},
{
"cpes": [
"cpe:2.3:o:gl-inet:x3000_firmware:4.4.8:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "x3000_firmware",
"vendor": "gl-inet",
"versions": [
{
"status": "affected",
"version": "4.4.8"
}
]
},
{
"cpes": [
"cpe:2.3:o:gl-inet:xe300_firmware:4.4.8:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "xe300_firmware",
"vendor": "gl-inet",
"versions": [
{
"status": "affected",
"version": "4.4.8"
}
]
},
{
"cpes": [
"cpe:2.3:o:gl-inet:xe300_firmware:4.3.16:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "xe300_firmware",
"vendor": "gl-inet",
"versions": [
{
"status": "affected",
"version": "4.3.16"
}
]
},
{
"cpes": [
"cpe:2.3:o:gl-inet:e750_firmware:4.3.12:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "e750_firmware",
"vendor": "gl-inet",
"versions": [
{
"status": "affected",
"version": "4.3.12"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2024-39228",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-08-08T14:17:52.681206Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-78",
"description": "CWE-78 Improper Neutralization of Special Elements used in an OS Command (\u0027OS Command Injection\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-08-08T14:46:57.158Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "GL-iNet products AR750/AR750S/AR300M/AR300M16/MT300N-V2/B1300/MT1300/SFT1200/X750 v4.3.11, MT3000/MT2500/AXT1800/AX1800/A1300/X300B v4.5.16, XE300 v4.3.16, E750 v4.3.12, AP1300/S1300 v4.3.13, and XE3000/X3000 v4.4 were discovered to contain a shell injection vulnerability via the interface check_ovpn_client_config and check_config."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-08-15T15:36:52.684Z",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"url": "https://github.com/gl-inet/CVE-issues/blob/main/4.0.0/Ovpn%20interface%20shell%20injection.md"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2024-39228",
"datePublished": "2024-08-06T00:00:00.000Z",
"dateReserved": "2024-06-21T00:00:00.000Z",
"dateUpdated": "2024-08-15T15:36:52.684Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2024-39229 (GCVE-0-2024-39229)
Vulnerability from cvelistv5 – Published: 2024-08-06 00:00 – Updated: 2024-11-21 18:43
VLAI
EPSS
VEX
Summary
An issue in GL-iNet products AR750/AR750S/AR300M/AR300M16/MT300N-V2/B1300/MT1300/SFT1200/X750 v4.3.11, MT3000/MT2500/AXT1800/AX1800/A1300/X300B v4.5.16, XE300 v4.3.16, E750 v4.3.12, AP1300/S1300 v4.3.13, XE3000/X3000 v4, and B2200/MV1000/MV1000W/USB150/N300/SF1200 v3.216 allows attackers to intercept communications via a man-in-the-middle attack when DDNS clients are reporting data to the server.
Severity
6.5 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2024-08-08 15:41 UTC
CWE
- n/a
- CWE-924 - Improper Enforcement of Message Integrity During Transmission in a Communication Channel
Assigner
References
1 reference
{
"containers": {
"adp": [
{
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2024-39229",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-08-08T15:41:13.508119Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-924",
"description": "CWE-924 Improper Enforcement of Message Integrity During Transmission in a Communication Channel",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-11-21T18:43:08.245Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "An issue in GL-iNet products AR750/AR750S/AR300M/AR300M16/MT300N-V2/B1300/MT1300/SFT1200/X750 v4.3.11, MT3000/MT2500/AXT1800/AX1800/A1300/X300B v4.5.16, XE300 v4.3.16, E750 v4.3.12, AP1300/S1300 v4.3.13, XE3000/X3000 v4, and B2200/MV1000/MV1000W/USB150/N300/SF1200 v3.216 allows attackers to intercept communications via a man-in-the-middle attack when DDNS clients are reporting data to the server."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-08-15T15:34:59.730Z",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"url": "https://github.com/gl-inet/CVE-issues/blob/main/4.0.0/DDNS%20data%20is%20not%20encrypted.md"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2024-39229",
"datePublished": "2024-08-06T00:00:00.000Z",
"dateReserved": "2024-06-21T00:00:00.000Z",
"dateUpdated": "2024-11-21T18:43:08.245Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2024-39225 (GCVE-0-2024-39225)
Vulnerability from cvelistv5 – Published: 2024-08-06 00:00 – Updated: 2024-08-15 15:31
VLAI
EPSS
VEX
Summary
GL-iNet products AR750/AR750S/AR300M/AR300M16/MT300N-V2/B1300/MT1300/SFT1200/X750 v4.3.11, MT3000/MT2500/AXT1800/AX1800/A1300/X300B v4.5.16, XE300 v4.3.16, E750 v4.3.12, AP1300/S1300 v4.3.13, and XE3000/X3000 v4.4 were discovered to contain a remote code execution (RCE) vulnerability.
Severity
9.8 (Critical)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2024-08-08 14:48 UTC
CWE
- n/a
- CWE-307 - Improper Restriction of Excessive Authentication Attempts
Assigner
References
1 reference
Impacted products
28 products
| Vendor | Product | Version | |
|---|---|---|---|
| gl-inet | mt6000_firmware |
Affected:
4.5.8
cpe:2.3:o:gl-inet:mt6000_firmware:4.5.8:*:*:*:*:*:*:* |
|
| gl-inet | a1300_firmware |
Affected:
4.5.16
cpe:2.3:o:gl-inet:a1300_firmware:4.5.16:*:*:*:*:*:*:* |
|
| gl-inet | x300b_firmware |
Affected:
4.5.16
cpe:2.3:o:gl-inet:x300b_firmware:4.5.16:*:*:*:*:*:*:* |
|
| gl-inet | ax1800_firmware |
Affected:
4.5.16
cpe:2.3:o:gl-inet:ax1800_firmware:4.5.16:*:*:*:*:*:*:* |
|
| gl-inet | axt1800_firmware |
Affected:
4.5.16
cpe:2.3:o:gl-inet:axt1800_firmware:4.5.16:*:*:*:*:*:*:* |
|
| gl-inet | mt2500_firmware |
Affected:
4.5.16
cpe:2.3:o:gl-inet:mt2500_firmware:4.5.16:*:*:*:*:*:*:* |
|
| gl-inet | mt3000_firmware |
Affected:
4.5.16
cpe:2.3:o:gl-inet:mt3000_firmware:4.5.16:*:*:*:*:*:*:* |
|
| gl-inet | x3000_firmware |
Affected:
4.4.8
cpe:2.3:o:gl-inet:x3000_firmware:4.4.8:*:*:*:*:*:*:* |
|
| gl-inet | xe3000_firmware |
Affected:
4.4.8
cpe:2.3:o:gl-inet:xe3000_firmware:4.4.8:*:*:*:*:*:*:* |
|
| gl-inet | xe300_firmware |
Affected:
4.3.16
cpe:2.3:o:gl-inet:xe300_firmware:4.3.16:*:*:*:*:*:*:* |
|
| gl-inet | e750_firmware |
Affected:
4.3.12
cpe:2.3:o:gl-inet:e750_firmware:4.3.12:*:*:*:*:*:*:* |
|
| gl-inet | x750_firmware |
Affected:
4.3.11
cpe:2.3:o:gl-inet:x750_firmware:4.3.11:*:*:*:*:*:*:* |
|
| gl-inet | sft1200_firmware |
Affected:
4.3.11
cpe:2.3:o:gl-inet:sft1200_firmware:4.3.11:*:*:*:*:*:*:* |
|
| gl-inet | ar300m_firmware |
Affected:
4.3.11
cpe:2.3:o:gl-inet:ar300m_firmware:4.3.11:*:*:*:*:*:*:* |
|
| gl-inet | ar300m16_firmware |
Affected:
4.3.11
cpe:2.3:o:gl-inet:ar300m16_firmware:4.3.11:*:*:*:*:*:*:* |
|
| gl-inet | ar750_firmware |
Affected:
4.3.11
cpe:2.3:o:gl-inet:ar750_firmware:4.3.11:*:*:*:*:*:*:* |
|
| gl-inet | ar750s_firmware |
Affected:
4.3.11
cpe:2.3:o:gl-inet:ar750s_firmware:4.3.11:*:*:*:*:*:*:* |
|
| gl-inet | b1300_firmware |
Affected:
4.3.11
cpe:2.3:o:gl-inet:b1300_firmware:4.3.11:*:*:*:*:*:*:* |
|
| gl-inet | mt1300_firmware |
Affected:
4.3.11
cpe:2.3:o:gl-inet:mt1300_firmware:4.3.11:*:*:*:*:*:*:* |
|
| gl-inet | mt300n-v2_firmware |
Affected:
4.3.11
cpe:2.3:o:gl-inet:mt300n-v2_firmware:4.3.11:*:*:*:*:*:*:* |
|
| gl-inet | ap1300_firmware |
Affected:
3.217
cpe:2.3:o:gl-inet:ap1300_firmware:3.217:*:*:*:*:*:*:* |
|
| gl-inet | b2200_firmware |
Affected:
3.216
cpe:2.3:o:gl-inet:b2200_firmware:3.216:*:*:*:*:*:*:* |
|
| gl-inet | mv1000_firmware |
Affected:
3.216
cpe:2.3:o:gl-inet:mv1000_firmware:3.216:*:*:*:*:*:*:* |
|
| gl-inet | mv1000w_firmware |
Affected:
3.216
cpe:2.3:o:gl-inet:mv1000w_firmware:3.216:*:*:*:*:*:*:* |
|
| gl-inet | usb150_firmware |
Affected:
3.216
cpe:2.3:o:gl-inet:usb150_firmware:3.216:*:*:*:*:*:*:* |
|
| gl-inet | sf1200_firmware |
Affected:
3.216
cpe:2.3:o:gl-inet:sf1200_firmware:3.216:*:*:*:*:*:*:* |
|
| gl-inet | n300_firmware |
Affected:
3.216
cpe:2.3:o:gl-inet:n300_firmware:3.216:*:*:*:*:*:*:* |
|
| gl-inet | s1300_firmware |
Affected:
3.216
cpe:2.3:o:gl-inet:s1300_firmware:3.216:*:*:*:*:*:*:* |
{
"containers": {
"adp": [
{
"affected": [
{
"cpes": [
"cpe:2.3:o:gl-inet:mt6000_firmware:4.5.8:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "mt6000_firmware",
"vendor": "gl-inet",
"versions": [
{
"status": "affected",
"version": "4.5.8"
}
]
},
{
"cpes": [
"cpe:2.3:o:gl-inet:a1300_firmware:4.5.16:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "a1300_firmware",
"vendor": "gl-inet",
"versions": [
{
"status": "affected",
"version": "4.5.16"
}
]
},
{
"cpes": [
"cpe:2.3:o:gl-inet:x300b_firmware:4.5.16:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "x300b_firmware",
"vendor": "gl-inet",
"versions": [
{
"status": "affected",
"version": "4.5.16"
}
]
},
{
"cpes": [
"cpe:2.3:o:gl-inet:ax1800_firmware:4.5.16:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "ax1800_firmware",
"vendor": "gl-inet",
"versions": [
{
"status": "affected",
"version": "4.5.16"
}
]
},
{
"cpes": [
"cpe:2.3:o:gl-inet:axt1800_firmware:4.5.16:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "axt1800_firmware",
"vendor": "gl-inet",
"versions": [
{
"status": "affected",
"version": "4.5.16"
}
]
},
{
"cpes": [
"cpe:2.3:o:gl-inet:mt2500_firmware:4.5.16:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "mt2500_firmware",
"vendor": "gl-inet",
"versions": [
{
"status": "affected",
"version": "4.5.16"
}
]
},
{
"cpes": [
"cpe:2.3:o:gl-inet:mt3000_firmware:4.5.16:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "mt3000_firmware",
"vendor": "gl-inet",
"versions": [
{
"status": "affected",
"version": "4.5.16"
}
]
},
{
"cpes": [
"cpe:2.3:o:gl-inet:x3000_firmware:4.4.8:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "x3000_firmware",
"vendor": "gl-inet",
"versions": [
{
"status": "affected",
"version": "4.4.8"
}
]
},
{
"cpes": [
"cpe:2.3:o:gl-inet:xe3000_firmware:4.4.8:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "xe3000_firmware",
"vendor": "gl-inet",
"versions": [
{
"status": "affected",
"version": "4.4.8"
}
]
},
{
"cpes": [
"cpe:2.3:o:gl-inet:xe300_firmware:4.3.16:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "xe300_firmware",
"vendor": "gl-inet",
"versions": [
{
"status": "affected",
"version": "4.3.16"
}
]
},
{
"cpes": [
"cpe:2.3:o:gl-inet:e750_firmware:4.3.12:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "e750_firmware",
"vendor": "gl-inet",
"versions": [
{
"status": "affected",
"version": "4.3.12"
}
]
},
{
"cpes": [
"cpe:2.3:o:gl-inet:x750_firmware:4.3.11:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "x750_firmware",
"vendor": "gl-inet",
"versions": [
{
"status": "affected",
"version": "4.3.11"
}
]
},
{
"cpes": [
"cpe:2.3:o:gl-inet:sft1200_firmware:4.3.11:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "sft1200_firmware",
"vendor": "gl-inet",
"versions": [
{
"status": "affected",
"version": "4.3.11"
}
]
},
{
"cpes": [
"cpe:2.3:o:gl-inet:ar300m_firmware:4.3.11:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "ar300m_firmware",
"vendor": "gl-inet",
"versions": [
{
"status": "affected",
"version": "4.3.11"
}
]
},
{
"cpes": [
"cpe:2.3:o:gl-inet:ar300m16_firmware:4.3.11:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "ar300m16_firmware",
"vendor": "gl-inet",
"versions": [
{
"status": "affected",
"version": "4.3.11"
}
]
},
{
"cpes": [
"cpe:2.3:o:gl-inet:ar750_firmware:4.3.11:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "ar750_firmware",
"vendor": "gl-inet",
"versions": [
{
"status": "affected",
"version": "4.3.11"
}
]
},
{
"cpes": [
"cpe:2.3:o:gl-inet:ar750s_firmware:4.3.11:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "ar750s_firmware",
"vendor": "gl-inet",
"versions": [
{
"status": "affected",
"version": "4.3.11"
}
]
},
{
"cpes": [
"cpe:2.3:o:gl-inet:b1300_firmware:4.3.11:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "b1300_firmware",
"vendor": "gl-inet",
"versions": [
{
"status": "affected",
"version": "4.3.11"
}
]
},
{
"cpes": [
"cpe:2.3:o:gl-inet:mt1300_firmware:4.3.11:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "mt1300_firmware",
"vendor": "gl-inet",
"versions": [
{
"status": "affected",
"version": "4.3.11"
}
]
},
{
"cpes": [
"cpe:2.3:o:gl-inet:mt300n-v2_firmware:4.3.11:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "mt300n-v2_firmware",
"vendor": "gl-inet",
"versions": [
{
"status": "affected",
"version": "4.3.11"
}
]
},
{
"cpes": [
"cpe:2.3:o:gl-inet:ap1300_firmware:3.217:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "ap1300_firmware",
"vendor": "gl-inet",
"versions": [
{
"status": "affected",
"version": "3.217"
}
]
},
{
"cpes": [
"cpe:2.3:o:gl-inet:b2200_firmware:3.216:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "b2200_firmware",
"vendor": "gl-inet",
"versions": [
{
"status": "affected",
"version": "3.216"
}
]
},
{
"cpes": [
"cpe:2.3:o:gl-inet:mv1000_firmware:3.216:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "mv1000_firmware",
"vendor": "gl-inet",
"versions": [
{
"status": "affected",
"version": "3.216"
}
]
},
{
"cpes": [
"cpe:2.3:o:gl-inet:mv1000w_firmware:3.216:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "mv1000w_firmware",
"vendor": "gl-inet",
"versions": [
{
"status": "affected",
"version": "3.216"
}
]
},
{
"cpes": [
"cpe:2.3:o:gl-inet:usb150_firmware:3.216:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "usb150_firmware",
"vendor": "gl-inet",
"versions": [
{
"status": "affected",
"version": "3.216"
}
]
},
{
"cpes": [
"cpe:2.3:o:gl-inet:sf1200_firmware:3.216:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "sf1200_firmware",
"vendor": "gl-inet",
"versions": [
{
"status": "affected",
"version": "3.216"
}
]
},
{
"cpes": [
"cpe:2.3:o:gl-inet:n300_firmware:3.216:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "n300_firmware",
"vendor": "gl-inet",
"versions": [
{
"status": "affected",
"version": "3.216"
}
]
},
{
"cpes": [
"cpe:2.3:o:gl-inet:s1300_firmware:3.216:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "s1300_firmware",
"vendor": "gl-inet",
"versions": [
{
"status": "affected",
"version": "3.216"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2024-39225",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-08-08T14:48:57.143782Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-307",
"description": "CWE-307 Improper Restriction of Excessive Authentication Attempts",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-08-08T15:09:56.428Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "GL-iNet products AR750/AR750S/AR300M/AR300M16/MT300N-V2/B1300/MT1300/SFT1200/X750 v4.3.11, MT3000/MT2500/AXT1800/AX1800/A1300/X300B v4.5.16, XE300 v4.3.16, E750 v4.3.12, AP1300/S1300 v4.3.13, and XE3000/X3000 v4.4 were discovered to contain a remote code execution (RCE) vulnerability."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-08-15T15:31:54.275Z",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"url": "https://github.com/gl-inet/CVE-issues/blob/main/4.0.0/Bypass%20the%20login%20mechanism.md"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2024-39225",
"datePublished": "2024-08-06T00:00:00.000Z",
"dateReserved": "2024-06-21T00:00:00.000Z",
"dateUpdated": "2024-08-15T15:31:54.275Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2024-39227 (GCVE-0-2024-39227)
Vulnerability from cvelistv5 – Published: 2024-08-06 00:00 – Updated: 2024-08-15 15:40
VLAI
EPSS
VEX
Summary
GL-iNet products AR750/AR750S/AR300M/AR300M16/MT300N-V2/B1300/MT1300/SFT1200/X750 v4.3.11, MT3000/MT2500/AXT1800/AX1800/A1300/X300B v4.5.16, XE300 v4.3.16, E750 v4.3.12, AP1300/S1300 v4.3.13, and XE3000/X3000 v4.4 were discovered to contain insecure permissions in the endpoint /cgi-bin/glc. This vulnerability allows unauthenticated attackers to execute arbitrary code or possibly a directory traversal via crafted JSON data.
Severity
9.8 (Critical)
SSVC
Exploitation: poc
Automatable: yes
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2024-08-07 14:01 UTC
CWE
- n/a
- CWE-75 - Failure to Sanitize Special Elements into a Different Plane (Special Element Injection)
Assigner
References
1 reference
Impacted products
21 products
| Vendor | Product | Version | |
|---|---|---|---|
| gl-inet | gl-mt2500 |
Affected:
4.5.16
cpe:2.3:a:gl-inet:gl-mt2500:4.5.16:*:*:*:*:*:*:* |
|
| gl-inet | gl-axt1800 |
Affected:
4.5.16
cpe:2.3:a:gl-inet:gl-axt1800:4.5.16:*:*:*:*:*:*:* |
|
| gl-inet | gl-ax1800 |
Affected:
4.5.16
cpe:2.3:a:gl-inet:gl-ax1800:4.5.16:*:*:*:*:*:*:* |
|
| gl-inet | gl-a1300 |
Affected:
4.5.16
cpe:2.3:a:gl-inet:gl-a1300:4.5.16:*:*:*:*:*:*:* |
|
| gl-inet | gl-x300b |
Affected:
4.5.16
cpe:2.3:a:gl-inet:gl-x300b:4.5.16:*:*:*:*:*:*:* |
|
| gl-inet | gl-xe300 |
Affected:
4.3.16
cpe:2.3:a:gl-inet:gl-xe300:4.3.16:*:*:*:*:*:*:* |
|
| gl-inet | gl-e750 |
Affected:
4.3.12
cpe:2.3:a:gl-inet:gl-e750:4.3.12:*:*:*:*:*:*:* |
|
| gl-inet | gl-ap1300 |
Affected:
4.3.13
cpe:2.3:a:gl-inet:gl-ap1300:4.3.13:*:*:*:*:*:*:* |
|
| gl-inet | gl-s1300 |
Affected:
4.3.13
cpe:2.3:a:gl-inet:gl-s1300:4.3.13:*:*:*:*:*:*:* |
|
| gl-inet | gl-xe3000 |
Affected:
4.4
cpe:2.3:a:gl-inet:gl-xe3000:4.4:*:*:*:*:*:*:* |
|
| gl-inet | gl-x3000 |
Affected:
4.4
cpe:2.3:a:gl-inet:gl-x3000:4.4:*:*:*:*:*:*:* |
|
| gl-inet | gl-ar750 |
Affected:
4.3.11
cpe:2.3:a:gl-inet:gl-ar750:4.3.11:*:*:*:*:*:*:* |
|
| gl-inet | gl-ar750s |
Affected:
4.3.11
cpe:2.3:a:gl-inet:gl-ar750s:4.3.11:*:*:*:*:*:*:* |
|
| gl-inet | gl-ar300m |
Affected:
4.3.11
cpe:2.3:a:gl-inet:gl-ar300m:4.3.11:*:*:*:*:*:*:* |
|
| gl-inet | gl-ar300m16 |
Affected:
4.3.11
cpe:2.3:a:gl-inet:gl-ar300m16:4.3.11:*:*:*:*:*:*:* |
|
| gl-inet | gl-ar300n-v2 |
Affected:
4.3.11
cpe:2.3:a:gl-inet:gl-ar300n-v2:4.3.11:*:*:*:*:*:*:* |
|
| gl-inet | gl-b1300 |
Affected:
4.3.11
cpe:2.3:a:gl-inet:gl-b1300:4.3.11:*:*:*:*:*:*:* |
|
| gl-inet | gl-mt1300 |
Affected:
4.3.11
cpe:2.3:a:gl-inet:gl-mt1300:4.3.11:*:*:*:*:*:*:* |
|
| gl-inet | gl-sft1200 |
Affected:
4.3.11
cpe:2.3:a:gl-inet:gl-sft1200:4.3.11:*:*:*:*:*:*:* |
|
| gl-inet | gl-x750 |
Affected:
4.3.11
cpe:2.3:a:gl-inet:gl-x750:4.3.11:*:*:*:*:*:*:* |
|
| gl-inet | gl-mt3000 |
Affected:
4.5.16
cpe:2.3:a:gl-inet:gl-mt3000:4.5.16:*:*:*:*:*:*:* |
{
"containers": {
"adp": [
{
"affected": [
{
"cpes": [
"cpe:2.3:a:gl-inet:gl-mt2500:4.5.16:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "gl-mt2500",
"vendor": "gl-inet",
"versions": [
{
"status": "affected",
"version": "4.5.16"
}
]
},
{
"cpes": [
"cpe:2.3:a:gl-inet:gl-axt1800:4.5.16:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "gl-axt1800",
"vendor": "gl-inet",
"versions": [
{
"status": "affected",
"version": "4.5.16"
}
]
},
{
"cpes": [
"cpe:2.3:a:gl-inet:gl-ax1800:4.5.16:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "gl-ax1800",
"vendor": "gl-inet",
"versions": [
{
"status": "affected",
"version": "4.5.16"
}
]
},
{
"cpes": [
"cpe:2.3:a:gl-inet:gl-a1300:4.5.16:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "gl-a1300",
"vendor": "gl-inet",
"versions": [
{
"status": "affected",
"version": "4.5.16"
}
]
},
{
"cpes": [
"cpe:2.3:a:gl-inet:gl-x300b:4.5.16:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "gl-x300b",
"vendor": "gl-inet",
"versions": [
{
"status": "affected",
"version": "4.5.16"
}
]
},
{
"cpes": [
"cpe:2.3:a:gl-inet:gl-xe300:4.3.16:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "gl-xe300",
"vendor": "gl-inet",
"versions": [
{
"status": "affected",
"version": "4.3.16"
}
]
},
{
"cpes": [
"cpe:2.3:a:gl-inet:gl-e750:4.3.12:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "gl-e750",
"vendor": "gl-inet",
"versions": [
{
"status": "affected",
"version": "4.3.12"
}
]
},
{
"cpes": [
"cpe:2.3:a:gl-inet:gl-ap1300:4.3.13:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "gl-ap1300",
"vendor": "gl-inet",
"versions": [
{
"status": "affected",
"version": "4.3.13"
}
]
},
{
"cpes": [
"cpe:2.3:a:gl-inet:gl-s1300:4.3.13:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "gl-s1300",
"vendor": "gl-inet",
"versions": [
{
"status": "affected",
"version": "4.3.13"
}
]
},
{
"cpes": [
"cpe:2.3:a:gl-inet:gl-xe3000:4.4:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "gl-xe3000",
"vendor": "gl-inet",
"versions": [
{
"status": "affected",
"version": "4.4"
}
]
},
{
"cpes": [
"cpe:2.3:a:gl-inet:gl-x3000:4.4:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "gl-x3000",
"vendor": "gl-inet",
"versions": [
{
"status": "affected",
"version": "4.4"
}
]
},
{
"cpes": [
"cpe:2.3:a:gl-inet:gl-ar750:4.3.11:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "gl-ar750",
"vendor": "gl-inet",
"versions": [
{
"status": "affected",
"version": "4.3.11"
}
]
},
{
"cpes": [
"cpe:2.3:a:gl-inet:gl-ar750s:4.3.11:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "gl-ar750s",
"vendor": "gl-inet",
"versions": [
{
"status": "affected",
"version": "4.3.11"
}
]
},
{
"cpes": [
"cpe:2.3:a:gl-inet:gl-ar300m:4.3.11:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "gl-ar300m",
"vendor": "gl-inet",
"versions": [
{
"status": "affected",
"version": "4.3.11"
}
]
},
{
"cpes": [
"cpe:2.3:a:gl-inet:gl-ar300m16:4.3.11:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "gl-ar300m16",
"vendor": "gl-inet",
"versions": [
{
"status": "affected",
"version": "4.3.11"
}
]
},
{
"cpes": [
"cpe:2.3:a:gl-inet:gl-ar300n-v2:4.3.11:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "gl-ar300n-v2",
"vendor": "gl-inet",
"versions": [
{
"status": "affected",
"version": "4.3.11"
}
]
},
{
"cpes": [
"cpe:2.3:a:gl-inet:gl-b1300:4.3.11:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "gl-b1300",
"vendor": "gl-inet",
"versions": [
{
"status": "affected",
"version": "4.3.11"
}
]
},
{
"cpes": [
"cpe:2.3:a:gl-inet:gl-mt1300:4.3.11:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "gl-mt1300",
"vendor": "gl-inet",
"versions": [
{
"status": "affected",
"version": "4.3.11"
}
]
},
{
"cpes": [
"cpe:2.3:a:gl-inet:gl-sft1200:4.3.11:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "gl-sft1200",
"vendor": "gl-inet",
"versions": [
{
"status": "affected",
"version": "4.3.11"
}
]
},
{
"cpes": [
"cpe:2.3:a:gl-inet:gl-x750:4.3.11:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "gl-x750",
"vendor": "gl-inet",
"versions": [
{
"status": "affected",
"version": "4.3.11"
}
]
},
{
"cpes": [
"cpe:2.3:a:gl-inet:gl-mt3000:4.5.16:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "gl-mt3000",
"vendor": "gl-inet",
"versions": [
{
"status": "affected",
"version": "4.5.16"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2024-39227",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-08-07T14:01:03.559592Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-75",
"description": "CWE-75 Failure to Sanitize Special Elements into a Different Plane (Special Element Injection)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-08-07T14:56:43.943Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "GL-iNet products AR750/AR750S/AR300M/AR300M16/MT300N-V2/B1300/MT1300/SFT1200/X750 v4.3.11, MT3000/MT2500/AXT1800/AX1800/A1300/X300B v4.5.16, XE300 v4.3.16, E750 v4.3.12, AP1300/S1300 v4.3.13, and XE3000/X3000 v4.4 were discovered to contain insecure permissions in the endpoint /cgi-bin/glc. This vulnerability allows unauthenticated attackers to execute arbitrary code or possibly a directory traversal via crafted JSON data."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-08-15T15:40:35.188Z",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"url": "https://github.com/gl-inet/CVE-issues/blob/main/4.0.0/Access%20to%20the%20C%20library%20without%20logging%20in.md"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2024-39227",
"datePublished": "2024-08-06T00:00:00.000Z",
"dateReserved": "2024-06-21T00:00:00.000Z",
"dateUpdated": "2024-08-15T15:40:35.188Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2024-39226 (GCVE-0-2024-39226)
Vulnerability from cvelistv5 – Published: 2024-08-06 00:00 – Updated: 2024-11-12 17:08
VLAI
EPSS
VEX
Summary
GL-iNet products AR750/AR750S/AR300M/AR300M16/MT300N-V2/B1300/MT1300/SFT1200/X750 v4.3.11, MT3000/MT2500/AXT1800/AX1800/A1300/X300B v4.5.16, XE300 v4.3.16, E750 v4.3.12, AP1300/S1300 v4.3.13, and XE3000/X3000 v4.4 were discovered to contain a vulnerability can be exploited to manipulate routers by passing malicious shell commands through the s2s API.
Severity
4.3 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2024-08-16 16:17 UTC
CWE
- n/a
- CWE-77 - Improper Neutralization of Special Elements used in a Command ('Command Injection')
Assigner
References
1 reference
{
"containers": {
"adp": [
{
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "ADJACENT_NETWORK",
"availabilityImpact": "LOW",
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2024-39226",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-08-16T16:17:15.444790Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-77",
"description": "CWE-77 Improper Neutralization of Special Elements used in a Command (\u0027Command Injection\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-11-12T17:08:43.264Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "GL-iNet products AR750/AR750S/AR300M/AR300M16/MT300N-V2/B1300/MT1300/SFT1200/X750 v4.3.11, MT3000/MT2500/AXT1800/AX1800/A1300/X300B v4.5.16, XE300 v4.3.16, E750 v4.3.12, AP1300/S1300 v4.3.13, and XE3000/X3000 v4.4 were discovered to contain a vulnerability can be exploited to manipulate routers by passing malicious shell commands through the s2s API."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-08-15T15:44:08.680Z",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"url": "https://github.com/gl-inet/CVE-issues/blob/main/4.0.0/s2s%20interface%20shell%20injection.md"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2024-39226",
"datePublished": "2024-08-06T00:00:00.000Z",
"dateReserved": "2024-06-21T00:00:00.000Z",
"dateUpdated": "2024-11-12T17:08:43.264Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2024-27356 (GCVE-0-2024-27356)
Vulnerability from cvelistv5 – Published: 2024-02-27 00:00 – Updated: 2025-03-24 15:44
VLAI
EPSS
VEX
Summary
An issue was discovered on certain GL-iNet devices. Attackers can download files such as logs via commands, potentially obtaining critical user information. This affects MT6000 4.5.5, XE3000 4.4.4, X3000 4.4.5, MT3000 4.5.0, MT2500 4.5.0, AXT1800 4.5.0, AX1800 4.5.0, A1300 4.5.0, S200 4.1.4-0300, X750 4.3.7, SFT1200 4.3.7, XE300 4.3.7, MT1300 4.3.10, AR750 4.3.10, AR750S 4.3.10, AR300M 4.3.10, AR300M16 4.3.10, B1300 4.3.10, MT300N-v2 4.3.10, X300B 3.217, S1300 3.216, SF1200 3.216, MV1000 3.216, N300 3.216, B2200 3.216, and X1200 3.203.
Severity
7.5 (High)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2024-02-27 15:51 UTC
CWE
- n/a
- CWE-200 - Exposure of Sensitive Information to an Unauthorized Actor
Assigner
References
2 references
Impacted products
27 products
| Vendor | Product | Version | |
|---|---|---|---|
| gl-inet | mt1300 |
Affected:
4.3.10
cpe:2.3:a:gl-inet:mt1300:4.3.10:*:*:*:*:*:*:* |
|
| gl-inet | ar750 |
Affected:
4.3.10
cpe:2.3:a:gl-inet:ar750:4.3.10:*:*:*:*:*:*:* |
|
| gl-inet | ar750s |
Affected:
4.3.10
cpe:2.3:a:gl-inet:ar750s:4.3.10:*:*:*:*:*:*:* |
|
| gl.inet | MT6000 |
Affected:
4.5.5
cpe:2.3:h:gl.inet:MT6000:-:*:*:*:*:*:*:* |
|
| gl-inet | xe3000 |
Affected:
4.4.4
cpe:2.3:a:gl-inet:xe3000:4.4.4:*:*:*:*:*:*:* |
|
| gl-inet | x3000 |
Affected:
4.4.5
cpe:2.3:a:gl-inet:x3000:4.4.5:*:*:*:*:*:*:* |
|
| gl-inet | mt3000 |
Affected:
4.5.0
cpe:2.3:a:gl-inet:mt3000:4.5.0:*:*:*:*:*:*:* |
|
| gl-inet | mt2500 |
Affected:
4.5.0
cpe:2.3:a:gl-inet:mt2500:4.5.0:*:*:*:*:*:*:* |
|
| gl-inet | axt1800 |
Affected:
4.5.0
cpe:2.3:a:gl-inet:axt1800:4.5.0:*:*:*:*:*:*:* |
|
| gl-inet | ax1800 |
Affected:
4.5.0
cpe:2.3:a:gl-inet:ax1800:4.5.0:*:*:*:*:*:*:* |
|
| gl-inet | a1300 |
Affected:
4.5.0
cpe:2.3:a:gl-inet:a1300:4.5.0:*:*:*:*:*:*:* |
|
| gl-inet | s200 |
Affected:
4.1.4
cpe:2.3:a:gl-inet:s200:4.1.4:*:*:*:*:*:*:* |
|
| gl-inet | 0300 |
Affected:
4.3.7
cpe:2.3:a:gl-inet:0300:*:*:*:*:*:*:*:* |
|
| gl-inet | x750 |
Affected:
4.3.7
cpe:2.3:a:gl-inet:x750:4.3.7:*:*:*:*:*:*:* |
|
| gl-inet | sft1200 |
Affected:
4.3.7
cpe:2.3:a:gl-inet:sft1200:4.3.7:*:*:*:*:*:*:* |
|
| gl-inet | xe300 |
Affected:
4.3.7
cpe:2.3:a:gl-inet:xe300:4.3.7:*:*:*:*:*:*:* |
|
| gl-inet | ar3000m |
Affected:
4.3.10
cpe:2.3:a:gl-inet:ar3000m:4.3.10:*:*:*:*:*:*:* |
|
| gl-inet | ar3000m16 |
Affected:
4.3.10
cpe:2.3:a:gl-inet:ar3000m16:4.3.10:*:*:*:*:*:*:* |
|
| gl-inet | b1300 |
Affected:
4.3.10
cpe:2.3:a:gl-inet:b1300:4.3.10:*:*:*:*:*:*:* |
|
| gl-inet | mt300nv2 |
Affected:
4.3.10
cpe:2.3:a:gl-inet:mt300nv2:4.3.10:*:*:*:*:*:*:* |
|
| gl-inet | x300b |
Affected:
3.217
cpe:2.3:a:gl-inet:x300b:3.217:*:*:*:*:*:*:* |
|
| gl-inet | s1300 |
Affected:
3.216
cpe:2.3:a:gl-inet:s1300:3.216:*:*:*:*:*:*:* |
|
| gl-inet | sf1200 |
Affected:
3.216
cpe:2.3:a:gl-inet:sf1200:3.216:*:*:*:*:*:*:* |
|
| gl-inet | mv1000 |
Affected:
3.216
cpe:2.3:a:gl-inet:mv1000:3.216:*:*:*:*:*:*:* |
|
| gl-inet | n300 |
Affected:
3.216
cpe:2.3:a:gl-inet:n300:3.216:*:*:*:*:*:*:* |
|
| gl-inet | b2200 |
Affected:
3.216
cpe:2.3:a:gl-inet:b2200:3.216:*:*:*:*:*:*:* |
|
| gl-i | x1200 |
Affected:
3.203
cpe:2.3:a:gl-i:x1200:3.203:*:*:*:*:*:*:* |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-02T00:34:51.986Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_transferred"
],
"url": "https://gl-inet.com"
},
{
"tags": [
"x_transferred"
],
"url": "https://github.com/gl-inet/CVE-issues/blob/main/4.0.0/Download_file_vulnerability.md"
}
],
"title": "CVE Program Container"
},
{
"affected": [
{
"cpes": [
"cpe:2.3:a:gl-inet:mt1300:4.3.10:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "mt1300",
"vendor": "gl-inet",
"versions": [
{
"status": "affected",
"version": "4.3.10"
}
]
},
{
"cpes": [
"cpe:2.3:a:gl-inet:ar750:4.3.10:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "ar750",
"vendor": "gl-inet",
"versions": [
{
"status": "affected",
"version": "4.3.10"
}
]
},
{
"cpes": [
"cpe:2.3:a:gl-inet:ar750s:4.3.10:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "ar750s",
"vendor": "gl-inet",
"versions": [
{
"status": "affected",
"version": "4.3.10"
}
]
},
{
"cpes": [
"cpe:2.3:h:gl.inet:MT6000:-:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "MT6000",
"vendor": "gl.inet",
"versions": [
{
"status": "affected",
"version": "4.5.5"
}
]
},
{
"cpes": [
"cpe:2.3:a:gl-inet:xe3000:4.4.4:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "xe3000",
"vendor": "gl-inet",
"versions": [
{
"status": "affected",
"version": "4.4.4"
}
]
},
{
"cpes": [
"cpe:2.3:a:gl-inet:x3000:4.4.5:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "x3000",
"vendor": "gl-inet",
"versions": [
{
"status": "affected",
"version": "4.4.5"
}
]
},
{
"cpes": [
"cpe:2.3:a:gl-inet:mt3000:4.5.0:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "mt3000",
"vendor": "gl-inet",
"versions": [
{
"status": "affected",
"version": "4.5.0"
}
]
},
{
"cpes": [
"cpe:2.3:a:gl-inet:mt2500:4.5.0:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "mt2500",
"vendor": "gl-inet",
"versions": [
{
"status": "affected",
"version": "4.5.0"
}
]
},
{
"cpes": [
"cpe:2.3:a:gl-inet:axt1800:4.5.0:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "axt1800",
"vendor": "gl-inet",
"versions": [
{
"status": "affected",
"version": "4.5.0"
}
]
},
{
"cpes": [
"cpe:2.3:a:gl-inet:ax1800:4.5.0:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "ax1800",
"vendor": "gl-inet",
"versions": [
{
"status": "affected",
"version": "4.5.0"
}
]
},
{
"cpes": [
"cpe:2.3:a:gl-inet:a1300:4.5.0:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "a1300",
"vendor": "gl-inet",
"versions": [
{
"status": "affected",
"version": "4.5.0"
}
]
},
{
"cpes": [
"cpe:2.3:a:gl-inet:s200:4.1.4:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "s200",
"vendor": "gl-inet",
"versions": [
{
"status": "affected",
"version": "4.1.4"
}
]
},
{
"cpes": [
"cpe:2.3:a:gl-inet:0300:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "0300",
"vendor": "gl-inet",
"versions": [
{
"status": "affected",
"version": "4.3.7"
}
]
},
{
"cpes": [
"cpe:2.3:a:gl-inet:x750:4.3.7:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "x750",
"vendor": "gl-inet",
"versions": [
{
"status": "affected",
"version": "4.3.7"
}
]
},
{
"cpes": [
"cpe:2.3:a:gl-inet:sft1200:4.3.7:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "sft1200",
"vendor": "gl-inet",
"versions": [
{
"status": "affected",
"version": "4.3.7"
}
]
},
{
"cpes": [
"cpe:2.3:a:gl-inet:xe300:4.3.7:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "xe300",
"vendor": "gl-inet",
"versions": [
{
"status": "affected",
"version": "4.3.7"
}
]
},
{
"cpes": [
"cpe:2.3:a:gl-inet:ar3000m:4.3.10:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "ar3000m",
"vendor": "gl-inet",
"versions": [
{
"status": "affected",
"version": "4.3.10"
}
]
},
{
"cpes": [
"cpe:2.3:a:gl-inet:ar3000m16:4.3.10:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "ar3000m16",
"vendor": "gl-inet",
"versions": [
{
"status": "affected",
"version": "4.3.10"
}
]
},
{
"cpes": [
"cpe:2.3:a:gl-inet:b1300:4.3.10:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "b1300",
"vendor": "gl-inet",
"versions": [
{
"status": "affected",
"version": "4.3.10"
}
]
},
{
"cpes": [
"cpe:2.3:a:gl-inet:mt300nv2:4.3.10:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "mt300nv2",
"vendor": "gl-inet",
"versions": [
{
"status": "affected",
"version": "4.3.10"
}
]
},
{
"cpes": [
"cpe:2.3:a:gl-inet:x300b:3.217:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "x300b",
"vendor": "gl-inet",
"versions": [
{
"status": "affected",
"version": "3.217"
}
]
},
{
"cpes": [
"cpe:2.3:a:gl-inet:s1300:3.216:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "s1300",
"vendor": "gl-inet",
"versions": [
{
"status": "affected",
"version": "3.216"
}
]
},
{
"cpes": [
"cpe:2.3:a:gl-inet:sf1200:3.216:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "sf1200",
"vendor": "gl-inet",
"versions": [
{
"status": "affected",
"version": "3.216"
}
]
},
{
"cpes": [
"cpe:2.3:a:gl-inet:mv1000:3.216:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "mv1000",
"vendor": "gl-inet",
"versions": [
{
"status": "affected",
"version": "3.216"
}
]
},
{
"cpes": [
"cpe:2.3:a:gl-inet:n300:3.216:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "n300",
"vendor": "gl-inet",
"versions": [
{
"status": "affected",
"version": "3.216"
}
]
},
{
"cpes": [
"cpe:2.3:a:gl-inet:b2200:3.216:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "b2200",
"vendor": "gl-inet",
"versions": [
{
"status": "affected",
"version": "3.216"
}
]
},
{
"cpes": [
"cpe:2.3:a:gl-i:x1200:3.203:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "x1200",
"vendor": "gl-i",
"versions": [
{
"status": "affected",
"version": "3.203"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2024-27356",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-02-27T15:51:15.040940Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-200",
"description": "CWE-200 Exposure of Sensitive Information to an Unauthorized Actor",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-03-24T15:44:54.024Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "An issue was discovered on certain GL-iNet devices. Attackers can download files such as logs via commands, potentially obtaining critical user information. This affects MT6000 4.5.5, XE3000 4.4.4, X3000 4.4.5, MT3000 4.5.0, MT2500 4.5.0, AXT1800 4.5.0, AX1800 4.5.0, A1300 4.5.0, S200 4.1.4-0300, X750 4.3.7, SFT1200 4.3.7, XE300 4.3.7, MT1300 4.3.10, AR750 4.3.10, AR750S 4.3.10, AR300M 4.3.10, AR300M16 4.3.10, B1300 4.3.10, MT300N-v2 4.3.10, X300B 3.217, S1300 3.216, SF1200 3.216, MV1000 3.216, N300 3.216, B2200 3.216, and X1200 3.203."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-02-27T00:17:16.406Z",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"url": "https://gl-inet.com"
},
{
"url": "https://github.com/gl-inet/CVE-issues/blob/main/4.0.0/Download_file_vulnerability.md"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2024-27356",
"datePublished": "2024-02-27T00:00:00.000Z",
"dateReserved": "2024-02-25T00:00:00.000Z",
"dateUpdated": "2025-03-24T15:44:54.024Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}