Search
Find a vulnerability
Search criteria
24 vulnerabilities found for gl-xe300_firmware by gl-inet
CVE-2024-45263 (GCVE-0-2024-45263)
Vulnerability from nvd – Published: 2024-10-24 00:00 – Updated: 2024-10-28 18:52
VLAI
EPSS
VEX
Summary
An issue was discovered on certain GL-iNet devices, including MT6000, MT3000, MT2500, AXT1800, and AX1800 4.6.2. The upload interface allows the uploading of arbitrary files to the device. Once the device executes the files, it can lead to information leakage, enabling complete control.
Severity
8.8 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2024-10-28 18:34 UTC
CWE
- n/a
- CWE-434 - Unrestricted Upload of File with Dangerous Type
Assigner
References
1 reference
Impacted products
6 products
| Vendor | Product | Version | |
|---|---|---|---|
| gl-inet | gl-b3000_firmware |
Affected:
4.5.18 , < 4.5.19
(custom)
cpe:2.3:o:gl-inet:gl-b3000_firmware:*:*:*:*:*:*:*:* |
|
| gl-inet | gl-mt6000_firmware |
Affected:
4.6.2 , < 4.6.4
(custom)
cpe:2.3:o:gl-inet:gl-ax1800_firmware:*:*:*:*:*:*:*:* cpe:2.3:o:gl-inet:gl-axt1800_firmware:-:*:*:*:*:*:*:* cpe:2.3:o:gl-inet:gl-mt2500_firmware:-:*:*:*:*:*:*:* cpe:2.3:o:gl-inet:gl-mt3000_firmware:-:*:*:*:*:*:*:* cpe:2.3:o:gl-inet:gl-mt6000_firmware:*:*:*:*:*:*:*:* |
|
| gl-inet | gl-x300b_firmware |
Affected:
4.5.17 , < 4.5.18
(custom)
cpe:2.3:o:gl-inet:gl-a1300_firmware:-:*:*:*:*:*:*:* cpe:2.3:o:gl-inet:gl-x300b_firmware:-:*:*:*:*:*:*:* |
|
| gl-inet | gl-xe300_firmware |
Affected:
4.4.9 , < 4.4.10
(custom)
cpe:2.3:o:gl-inet:gl-x3000_firmware:-:*:*:*:*:*:*:* cpe:2.3:o:gl-inet:gl-xe300_firmware:-:*:*:*:*:*:*:* |
|
| gl-inet | gl-x750_firmware |
Affected:
4.3.18 , < 4.3.19
(custom)
cpe:2.3:o:gl-inet:gl-mt1300_firmware:-:*:*:*:*:*:*:* cpe:2.3:o:gl-inet:gl-sft1200_firmware:-:*:*:*:*:*:*:* cpe:2.3:o:gl-inet:gl-x750_firmware:-:*:*:*:*:*:*:* |
|
| gl-inet | gl-xe300_firmware |
Affected:
4.3.17 , < 4.3.18
(custom)
cpe:2.3:o:gl-inet:gl-ar300m16_firmware:*:*:*:*:*:*:*:* cpe:2.3:o:gl-inet:gl-ar750_firmware:-:*:*:*:*:*:*:* cpe:2.3:o:gl-inet:gl-ar300m_firmware:-:*:*:*:*:*:*:* cpe:2.3:o:gl-inet:gl-ar750s_firmware:-:*:*:*:*:*:*:* cpe:2.3:o:gl-inet:gl-b1300_firmware:-:*:*:*:*:*:*:* cpe:2.3:o:gl-inet:gl-e750_firmware:-:*:*:*:*:*:*:* cpe:2.3:o:gl-inet:gl-mt300n-v2_firmware:-:*:*:*:*:*:*:* cpe:2.3:o:gl-inet:gl-xe300_firmware:-:*:*:*:*:*:*:* |
{
"containers": {
"adp": [
{
"affected": [
{
"cpes": [
"cpe:2.3:o:gl-inet:gl-b3000_firmware:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "gl-b3000_firmware",
"vendor": "gl-inet",
"versions": [
{
"lessThan": "4.5.19",
"status": "affected",
"version": "4.5.18",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:o:gl-inet:gl-ax1800_firmware:*:*:*:*:*:*:*:*",
"cpe:2.3:o:gl-inet:gl-axt1800_firmware:-:*:*:*:*:*:*:*",
"cpe:2.3:o:gl-inet:gl-mt2500_firmware:-:*:*:*:*:*:*:*",
"cpe:2.3:o:gl-inet:gl-mt3000_firmware:-:*:*:*:*:*:*:*",
"cpe:2.3:o:gl-inet:gl-mt6000_firmware:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "gl-mt6000_firmware",
"vendor": "gl-inet",
"versions": [
{
"lessThan": "4.6.4",
"status": "affected",
"version": "4.6.2",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:o:gl-inet:gl-a1300_firmware:-:*:*:*:*:*:*:*",
"cpe:2.3:o:gl-inet:gl-x300b_firmware:-:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "gl-x300b_firmware",
"vendor": "gl-inet",
"versions": [
{
"lessThan": "4.5.18",
"status": "affected",
"version": "4.5.17",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:o:gl-inet:gl-x3000_firmware:-:*:*:*:*:*:*:*",
"cpe:2.3:o:gl-inet:gl-xe300_firmware:-:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "gl-xe300_firmware",
"vendor": "gl-inet",
"versions": [
{
"lessThan": "4.4.10",
"status": "affected",
"version": "4.4.9",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:o:gl-inet:gl-mt1300_firmware:-:*:*:*:*:*:*:*",
"cpe:2.3:o:gl-inet:gl-sft1200_firmware:-:*:*:*:*:*:*:*",
"cpe:2.3:o:gl-inet:gl-x750_firmware:-:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "gl-x750_firmware",
"vendor": "gl-inet",
"versions": [
{
"lessThan": "4.3.19",
"status": "affected",
"version": "4.3.18",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:o:gl-inet:gl-ar300m16_firmware:*:*:*:*:*:*:*:*",
"cpe:2.3:o:gl-inet:gl-ar750_firmware:-:*:*:*:*:*:*:*",
"cpe:2.3:o:gl-inet:gl-ar300m_firmware:-:*:*:*:*:*:*:*",
"cpe:2.3:o:gl-inet:gl-ar750s_firmware:-:*:*:*:*:*:*:*",
"cpe:2.3:o:gl-inet:gl-b1300_firmware:-:*:*:*:*:*:*:*",
"cpe:2.3:o:gl-inet:gl-e750_firmware:-:*:*:*:*:*:*:*",
"cpe:2.3:o:gl-inet:gl-mt300n-v2_firmware:-:*:*:*:*:*:*:*",
"cpe:2.3:o:gl-inet:gl-xe300_firmware:-:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "gl-xe300_firmware",
"vendor": "gl-inet",
"versions": [
{
"lessThan": "4.3.18",
"status": "affected",
"version": "4.3.17",
"versionType": "custom"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "ADJACENT_NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2024-45263",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-10-28T18:34:32.730872Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-434",
"description": "CWE-434 Unrestricted Upload of File with Dangerous Type",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-10-28T18:52:30.245Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "An issue was discovered on certain GL-iNet devices, including MT6000, MT3000, MT2500, AXT1800, and AX1800 4.6.2. The upload interface allows the uploading of arbitrary files to the device. Once the device executes the files, it can lead to information leakage, enabling complete control."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-10-24T20:21:28.712Z",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"url": "https://github.com/gl-inet/CVE-issues/blob/main/4.0.0/Arbitrary%20File%20Upload%20to%20ovpn_upload%20via%20Upload%20Interface.md"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2024-45263",
"datePublished": "2024-10-24T00:00:00.000Z",
"dateReserved": "2024-08-25T00:00:00.000Z",
"dateUpdated": "2024-10-28T18:52:30.245Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2024-45262 (GCVE-0-2024-45262)
Vulnerability from nvd – Published: 2024-10-24 00:00 – Updated: 2024-10-28 19:22
VLAI
EPSS
VEX
Summary
An issue was discovered on certain GL-iNet devices, including MT6000, MT3000, MT2500, AXT1800, and AX1800 4.6.2. The params parameter in the call method of the /rpc endpoint is vulnerable to arbitrary directory traversal, which enables attackers to execute scripts under any path.
Severity
8.8 (High)
SSVC
Exploitation: poc
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2024-10-28 19:21 UTC
CWE
- n/a
- CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Assigner
References
1 reference
Impacted products
6 products
| Vendor | Product | Version | |
|---|---|---|---|
| gl-inet | gl-b3000_firmware |
Affected:
4.5.18 , < 4.5.19
(custom)
cpe:2.3:o:gl-inet:gl-b3000_firmware:*:*:*:*:*:*:*:* |
|
| gl-inet | gl-mt6000_firmware |
Affected:
4.6.2 , < 4.6.4
(custom)
cpe:2.3:o:gl-inet:gl-ax1800_firmware:*:*:*:*:*:*:*:* cpe:2.3:o:gl-inet:gl-axt1800_firmware:-:*:*:*:*:*:*:* cpe:2.3:o:gl-inet:gl-mt2500_firmware:-:*:*:*:*:*:*:* cpe:2.3:o:gl-inet:gl-mt3000_firmware:-:*:*:*:*:*:*:* cpe:2.3:o:gl-inet:gl-mt6000_firmware:*:*:*:*:*:*:*:* |
|
| gl-inet | gl-x300b_firmware |
Affected:
4.5.17 , < 4.5.18
(custom)
cpe:2.3:o:gl-inet:gl-a1300_firmware:-:*:*:*:*:*:*:* cpe:2.3:o:gl-inet:gl-x300b_firmware:-:*:*:*:*:*:*:* |
|
| gl-inet | gl-xe300_firmware |
Affected:
4.4.9 , < 4.4.10
(custom)
cpe:2.3:o:gl-inet:gl-x3000_firmware:-:*:*:*:*:*:*:* cpe:2.3:o:gl-inet:gl-xe300_firmware:-:*:*:*:*:*:*:* |
|
| gl-inet | gl-x750_firmware |
Affected:
4.3.18 , < 4.3.19
(custom)
cpe:2.3:o:gl-inet:gl-mt1300_firmware:-:*:*:*:*:*:*:* cpe:2.3:o:gl-inet:gl-sft1200_firmware:-:*:*:*:*:*:*:* cpe:2.3:o:gl-inet:gl-x750_firmware:-:*:*:*:*:*:*:* |
|
| gl-inet | gl-xe300_firmware |
Affected:
4.3.17 , < 4.3.18
(custom)
cpe:2.3:o:gl-inet:gl-ar300m16_firmware:*:*:*:*:*:*:*:* cpe:2.3:o:gl-inet:gl-ar750_firmware:-:*:*:*:*:*:*:* cpe:2.3:o:gl-inet:gl-ar300m_firmware:-:*:*:*:*:*:*:* cpe:2.3:o:gl-inet:gl-ar750s_firmware:-:*:*:*:*:*:*:* cpe:2.3:o:gl-inet:gl-b1300_firmware:-:*:*:*:*:*:*:* cpe:2.3:o:gl-inet:gl-e750_firmware:-:*:*:*:*:*:*:* cpe:2.3:o:gl-inet:gl-mt300n-v2_firmware:-:*:*:*:*:*:*:* cpe:2.3:o:gl-inet:gl-xe300_firmware:-:*:*:*:*:*:*:* |
{
"containers": {
"adp": [
{
"affected": [
{
"cpes": [
"cpe:2.3:o:gl-inet:gl-b3000_firmware:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "gl-b3000_firmware",
"vendor": "gl-inet",
"versions": [
{
"lessThan": "4.5.19",
"status": "affected",
"version": "4.5.18",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:o:gl-inet:gl-ax1800_firmware:*:*:*:*:*:*:*:*",
"cpe:2.3:o:gl-inet:gl-axt1800_firmware:-:*:*:*:*:*:*:*",
"cpe:2.3:o:gl-inet:gl-mt2500_firmware:-:*:*:*:*:*:*:*",
"cpe:2.3:o:gl-inet:gl-mt3000_firmware:-:*:*:*:*:*:*:*",
"cpe:2.3:o:gl-inet:gl-mt6000_firmware:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "gl-mt6000_firmware",
"vendor": "gl-inet",
"versions": [
{
"lessThan": "4.6.4",
"status": "affected",
"version": "4.6.2",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:o:gl-inet:gl-a1300_firmware:-:*:*:*:*:*:*:*",
"cpe:2.3:o:gl-inet:gl-x300b_firmware:-:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "gl-x300b_firmware",
"vendor": "gl-inet",
"versions": [
{
"lessThan": "4.5.18",
"status": "affected",
"version": "4.5.17",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:o:gl-inet:gl-x3000_firmware:-:*:*:*:*:*:*:*",
"cpe:2.3:o:gl-inet:gl-xe300_firmware:-:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "gl-xe300_firmware",
"vendor": "gl-inet",
"versions": [
{
"lessThan": "4.4.10",
"status": "affected",
"version": "4.4.9",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:o:gl-inet:gl-mt1300_firmware:-:*:*:*:*:*:*:*",
"cpe:2.3:o:gl-inet:gl-sft1200_firmware:-:*:*:*:*:*:*:*",
"cpe:2.3:o:gl-inet:gl-x750_firmware:-:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "gl-x750_firmware",
"vendor": "gl-inet",
"versions": [
{
"lessThan": "4.3.19",
"status": "affected",
"version": "4.3.18",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:o:gl-inet:gl-ar300m16_firmware:*:*:*:*:*:*:*:*",
"cpe:2.3:o:gl-inet:gl-ar750_firmware:-:*:*:*:*:*:*:*",
"cpe:2.3:o:gl-inet:gl-ar300m_firmware:-:*:*:*:*:*:*:*",
"cpe:2.3:o:gl-inet:gl-ar750s_firmware:-:*:*:*:*:*:*:*",
"cpe:2.3:o:gl-inet:gl-b1300_firmware:-:*:*:*:*:*:*:*",
"cpe:2.3:o:gl-inet:gl-e750_firmware:-:*:*:*:*:*:*:*",
"cpe:2.3:o:gl-inet:gl-mt300n-v2_firmware:-:*:*:*:*:*:*:*",
"cpe:2.3:o:gl-inet:gl-xe300_firmware:-:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "gl-xe300_firmware",
"vendor": "gl-inet",
"versions": [
{
"lessThan": "4.3.18",
"status": "affected",
"version": "4.3.17",
"versionType": "custom"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "ADJACENT_NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2024-45262",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-10-28T19:21:47.832625Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-22",
"description": "CWE-22 Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-10-28T19:22:25.505Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "An issue was discovered on certain GL-iNet devices, including MT6000, MT3000, MT2500, AXT1800, and AX1800 4.6.2. The params parameter in the call method of the /rpc endpoint is vulnerable to arbitrary directory traversal, which enables attackers to execute scripts under any path."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-10-24T20:19:54.001Z",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"url": "https://github.com/gl-inet/CVE-issues/blob/main/4.0.0/Improper%20Pathname%20Restriction%20Leading%20to%20Path%20Traversal%20in%20Restricted%20Directories.md"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2024-45262",
"datePublished": "2024-10-24T00:00:00.000Z",
"dateReserved": "2024-08-25T00:00:00.000Z",
"dateUpdated": "2024-10-28T19:22:25.505Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2024-45261 (GCVE-0-2024-45261)
Vulnerability from nvd – Published: 2024-10-24 00:00 – Updated: 2024-10-28 19:19
VLAI
EPSS
VEX
Summary
An issue was discovered on certain GL-iNet devices, including MT6000, MT3000, MT2500, AXT1800, and AX1800 4.6.2. The SID generated for a specific user is not tied to that user itself, which allows other users to potentially use it for authentication. Once an attacker bypasses the application's authentication procedures, they can generate a valid SID, escalate privileges, and gain full control.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2024-10-28 19:12 UTC
CWE
- n/a
- CWE-863 - Incorrect Authorization
Assigner
References
1 reference
Impacted products
6 products
| Vendor | Product | Version | |
|---|---|---|---|
| gl-inet | gl-b3000_firmware |
Affected:
4.5.18 , < 4.5.19
(custom)
cpe:2.3:o:gl-inet:gl-b3000_firmware:*:*:*:*:*:*:*:* |
|
| gl-inet | gl-mt6000_firmware |
Affected:
4.6.2 , < 4.6.4
(custom)
cpe:2.3:o:gl-inet:gl-ax1800_firmware:*:*:*:*:*:*:*:* cpe:2.3:o:gl-inet:gl-axt1800_firmware:-:*:*:*:*:*:*:* cpe:2.3:o:gl-inet:gl-mt2500_firmware:-:*:*:*:*:*:*:* cpe:2.3:o:gl-inet:gl-mt3000_firmware:-:*:*:*:*:*:*:* cpe:2.3:o:gl-inet:gl-mt6000_firmware:*:*:*:*:*:*:*:* |
|
| gl-inet | gl-x300b_firmware |
Affected:
4.5.17 , < 4.5.18
(custom)
cpe:2.3:o:gl-inet:gl-a1300_firmware:-:*:*:*:*:*:*:* cpe:2.3:o:gl-inet:gl-x300b_firmware:-:*:*:*:*:*:*:* |
|
| gl-inet | gl-xe300_firmware |
Affected:
4.4.9 , < 4.4.10
(custom)
cpe:2.3:o:gl-inet:gl-x3000_firmware:-:*:*:*:*:*:*:* cpe:2.3:o:gl-inet:gl-xe300_firmware:-:*:*:*:*:*:*:* |
|
| gl-inet | gl-x750_firmware |
Affected:
4.3.18 , < 4.3.19
(custom)
cpe:2.3:o:gl-inet:gl-mt1300_firmware:-:*:*:*:*:*:*:* cpe:2.3:o:gl-inet:gl-sft1200_firmware:-:*:*:*:*:*:*:* cpe:2.3:o:gl-inet:gl-x750_firmware:-:*:*:*:*:*:*:* |
|
| gl-inet | gl-xe300_firmware |
Affected:
4.3.17 , < 4.3.18
(custom)
cpe:2.3:o:gl-inet:gl-ar300m16_firmware:*:*:*:*:*:*:*:* cpe:2.3:o:gl-inet:gl-ar750_firmware:-:*:*:*:*:*:*:* cpe:2.3:o:gl-inet:gl-ar300m_firmware:-:*:*:*:*:*:*:* cpe:2.3:o:gl-inet:gl-ar750s_firmware:-:*:*:*:*:*:*:* cpe:2.3:o:gl-inet:gl-b1300_firmware:-:*:*:*:*:*:*:* cpe:2.3:o:gl-inet:gl-e750_firmware:-:*:*:*:*:*:*:* cpe:2.3:o:gl-inet:gl-mt300n-v2_firmware:-:*:*:*:*:*:*:* cpe:2.3:o:gl-inet:gl-xe300_firmware:-:*:*:*:*:*:*:* |
{
"containers": {
"adp": [
{
"affected": [
{
"cpes": [
"cpe:2.3:o:gl-inet:gl-b3000_firmware:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "gl-b3000_firmware",
"vendor": "gl-inet",
"versions": [
{
"lessThan": "4.5.19",
"status": "affected",
"version": "4.5.18",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:o:gl-inet:gl-ax1800_firmware:*:*:*:*:*:*:*:*",
"cpe:2.3:o:gl-inet:gl-axt1800_firmware:-:*:*:*:*:*:*:*",
"cpe:2.3:o:gl-inet:gl-mt2500_firmware:-:*:*:*:*:*:*:*",
"cpe:2.3:o:gl-inet:gl-mt3000_firmware:-:*:*:*:*:*:*:*",
"cpe:2.3:o:gl-inet:gl-mt6000_firmware:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "gl-mt6000_firmware",
"vendor": "gl-inet",
"versions": [
{
"lessThan": "4.6.4",
"status": "affected",
"version": "4.6.2",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:o:gl-inet:gl-a1300_firmware:-:*:*:*:*:*:*:*",
"cpe:2.3:o:gl-inet:gl-x300b_firmware:-:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "gl-x300b_firmware",
"vendor": "gl-inet",
"versions": [
{
"lessThan": "4.5.18",
"status": "affected",
"version": "4.5.17",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:o:gl-inet:gl-x3000_firmware:-:*:*:*:*:*:*:*",
"cpe:2.3:o:gl-inet:gl-xe300_firmware:-:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "gl-xe300_firmware",
"vendor": "gl-inet",
"versions": [
{
"lessThan": "4.4.10",
"status": "affected",
"version": "4.4.9",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:o:gl-inet:gl-mt1300_firmware:-:*:*:*:*:*:*:*",
"cpe:2.3:o:gl-inet:gl-sft1200_firmware:-:*:*:*:*:*:*:*",
"cpe:2.3:o:gl-inet:gl-x750_firmware:-:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "gl-x750_firmware",
"vendor": "gl-inet",
"versions": [
{
"lessThan": "4.3.19",
"status": "affected",
"version": "4.3.18",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:o:gl-inet:gl-ar300m16_firmware:*:*:*:*:*:*:*:*",
"cpe:2.3:o:gl-inet:gl-ar750_firmware:-:*:*:*:*:*:*:*",
"cpe:2.3:o:gl-inet:gl-ar300m_firmware:-:*:*:*:*:*:*:*",
"cpe:2.3:o:gl-inet:gl-ar750s_firmware:-:*:*:*:*:*:*:*",
"cpe:2.3:o:gl-inet:gl-b1300_firmware:-:*:*:*:*:*:*:*",
"cpe:2.3:o:gl-inet:gl-e750_firmware:-:*:*:*:*:*:*:*",
"cpe:2.3:o:gl-inet:gl-mt300n-v2_firmware:-:*:*:*:*:*:*:*",
"cpe:2.3:o:gl-inet:gl-xe300_firmware:-:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "gl-xe300_firmware",
"vendor": "gl-inet",
"versions": [
{
"lessThan": "4.3.18",
"status": "affected",
"version": "4.3.17",
"versionType": "custom"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "ADJACENT_NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2024-45261",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-10-28T19:12:05.989024Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-863",
"description": "CWE-863 Incorrect Authorization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-10-28T19:19:59.290Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "An issue was discovered on certain GL-iNet devices, including MT6000, MT3000, MT2500, AXT1800, and AX1800 4.6.2. The SID generated for a specific user is not tied to that user itself, which allows other users to potentially use it for authentication. Once an attacker bypasses the application\u0027s authentication procedures, they can generate a valid SID, escalate privileges, and gain full control."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-10-24T20:18:25.796Z",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"url": "https://github.com/gl-inet/CVE-issues/blob/main/4.0.0/Bypassing%20Login%20Mechanism%20with%20Passwordless%20User%20Login.md"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2024-45261",
"datePublished": "2024-10-24T00:00:00.000Z",
"dateReserved": "2024-08-25T00:00:00.000Z",
"dateUpdated": "2024-10-28T19:19:59.290Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2024-45260 (GCVE-0-2024-45260)
Vulnerability from nvd – Published: 2024-10-24 00:00 – Updated: 2024-10-28 19:27
VLAI
EPSS
VEX
Summary
An issue was discovered on certain GL-iNet devices, including MT6000, MT3000, MT2500, AXT1800, and AX1800 4.6.2. Users who belong to unauthorized groups can invoke any interface of the device, thereby gaining complete control over it.
Severity
SSVC
Exploitation: poc
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2024-10-28 19:24 UTC
CWE
- n/a
- CWE-863 - Incorrect Authorization
Assigner
References
1 reference
Impacted products
6 products
| Vendor | Product | Version | |
|---|---|---|---|
| gl-inet | gl-b3000_firmware |
Affected:
4.5.18 , < 4.5.19
(custom)
cpe:2.3:o:gl-inet:gl-b3000_firmware:*:*:*:*:*:*:*:* |
|
| gl-inet | gl-mt6000_firmware |
Affected:
4.6.2 , < 4.6.4
(custom)
cpe:2.3:o:gl-inet:gl-ax1800_firmware:*:*:*:*:*:*:*:* cpe:2.3:o:gl-inet:gl-axt1800_firmware:-:*:*:*:*:*:*:* cpe:2.3:o:gl-inet:gl-mt2500_firmware:-:*:*:*:*:*:*:* cpe:2.3:o:gl-inet:gl-mt3000_firmware:-:*:*:*:*:*:*:* cpe:2.3:o:gl-inet:gl-mt6000_firmware:*:*:*:*:*:*:*:* |
|
| gl-inet | gl-x300b_firmware |
Affected:
4.5.17 , < 4.5.18
(custom)
cpe:2.3:o:gl-inet:gl-a1300_firmware:-:*:*:*:*:*:*:* cpe:2.3:o:gl-inet:gl-x300b_firmware:-:*:*:*:*:*:*:* |
|
| gl-inet | gl-xe300_firmware |
Affected:
4.4.9 , < 4.4.10
(custom)
cpe:2.3:o:gl-inet:gl-x3000_firmware:-:*:*:*:*:*:*:* cpe:2.3:o:gl-inet:gl-xe300_firmware:-:*:*:*:*:*:*:* |
|
| gl-inet | gl-x750_firmware |
Affected:
4.3.18 , < 4.3.19
(custom)
cpe:2.3:o:gl-inet:gl-mt1300_firmware:-:*:*:*:*:*:*:* cpe:2.3:o:gl-inet:gl-sft1200_firmware:-:*:*:*:*:*:*:* cpe:2.3:o:gl-inet:gl-x750_firmware:-:*:*:*:*:*:*:* |
|
| gl-inet | gl-xe300_firmware |
Affected:
4.3.17 , < 4.3.18
(custom)
cpe:2.3:o:gl-inet:gl-ar300m16_firmware:*:*:*:*:*:*:*:* cpe:2.3:o:gl-inet:gl-ar750_firmware:-:*:*:*:*:*:*:* cpe:2.3:o:gl-inet:gl-ar300m_firmware:-:*:*:*:*:*:*:* cpe:2.3:o:gl-inet:gl-ar750s_firmware:-:*:*:*:*:*:*:* cpe:2.3:o:gl-inet:gl-b1300_firmware:-:*:*:*:*:*:*:* cpe:2.3:o:gl-inet:gl-e750_firmware:-:*:*:*:*:*:*:* cpe:2.3:o:gl-inet:gl-mt300n-v2_firmware:-:*:*:*:*:*:*:* cpe:2.3:o:gl-inet:gl-xe300_firmware:-:*:*:*:*:*:*:* |
{
"containers": {
"adp": [
{
"affected": [
{
"cpes": [
"cpe:2.3:o:gl-inet:gl-b3000_firmware:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "gl-b3000_firmware",
"vendor": "gl-inet",
"versions": [
{
"lessThan": "4.5.19",
"status": "affected",
"version": "4.5.18",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:o:gl-inet:gl-ax1800_firmware:*:*:*:*:*:*:*:*",
"cpe:2.3:o:gl-inet:gl-axt1800_firmware:-:*:*:*:*:*:*:*",
"cpe:2.3:o:gl-inet:gl-mt2500_firmware:-:*:*:*:*:*:*:*",
"cpe:2.3:o:gl-inet:gl-mt3000_firmware:-:*:*:*:*:*:*:*",
"cpe:2.3:o:gl-inet:gl-mt6000_firmware:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "gl-mt6000_firmware",
"vendor": "gl-inet",
"versions": [
{
"lessThan": "4.6.4",
"status": "affected",
"version": "4.6.2",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:o:gl-inet:gl-a1300_firmware:-:*:*:*:*:*:*:*",
"cpe:2.3:o:gl-inet:gl-x300b_firmware:-:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "gl-x300b_firmware",
"vendor": "gl-inet",
"versions": [
{
"lessThan": "4.5.18",
"status": "affected",
"version": "4.5.17",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:o:gl-inet:gl-x3000_firmware:-:*:*:*:*:*:*:*",
"cpe:2.3:o:gl-inet:gl-xe300_firmware:-:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "gl-xe300_firmware",
"vendor": "gl-inet",
"versions": [
{
"lessThan": "4.4.10",
"status": "affected",
"version": "4.4.9",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:o:gl-inet:gl-mt1300_firmware:-:*:*:*:*:*:*:*",
"cpe:2.3:o:gl-inet:gl-sft1200_firmware:-:*:*:*:*:*:*:*",
"cpe:2.3:o:gl-inet:gl-x750_firmware:-:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "gl-x750_firmware",
"vendor": "gl-inet",
"versions": [
{
"lessThan": "4.3.19",
"status": "affected",
"version": "4.3.18",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:o:gl-inet:gl-ar300m16_firmware:*:*:*:*:*:*:*:*",
"cpe:2.3:o:gl-inet:gl-ar750_firmware:-:*:*:*:*:*:*:*",
"cpe:2.3:o:gl-inet:gl-ar300m_firmware:-:*:*:*:*:*:*:*",
"cpe:2.3:o:gl-inet:gl-ar750s_firmware:-:*:*:*:*:*:*:*",
"cpe:2.3:o:gl-inet:gl-b1300_firmware:-:*:*:*:*:*:*:*",
"cpe:2.3:o:gl-inet:gl-e750_firmware:-:*:*:*:*:*:*:*",
"cpe:2.3:o:gl-inet:gl-mt300n-v2_firmware:-:*:*:*:*:*:*:*",
"cpe:2.3:o:gl-inet:gl-xe300_firmware:-:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "gl-xe300_firmware",
"vendor": "gl-inet",
"versions": [
{
"lessThan": "4.3.18",
"status": "affected",
"version": "4.3.17",
"versionType": "custom"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "ADJACENT_NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2024-45260",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-10-28T19:24:33.863289Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-863",
"description": "CWE-863 Incorrect Authorization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-10-28T19:27:01.398Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "An issue was discovered on certain GL-iNet devices, including MT6000, MT3000, MT2500, AXT1800, and AX1800 4.6.2. Users who belong to unauthorized groups can invoke any interface of the device, thereby gaining complete control over it."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-10-24T20:11:10.715Z",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"url": "https://github.com/gl-inet/CVE-issues/blob/main/4.0.0/Unauthorized%20Access%20to%20File%20Download%20and%20Upload%20Interfaces.md"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2024-45260",
"datePublished": "2024-10-24T00:00:00.000Z",
"dateReserved": "2024-08-25T00:00:00.000Z",
"dateUpdated": "2024-10-28T19:27:01.398Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2024-45259 (GCVE-0-2024-45259)
Vulnerability from nvd – Published: 2024-10-24 00:00 – Updated: 2024-10-28 19:38
VLAI
EPSS
VEX
Summary
An issue was discovered on certain GL-iNet devices, including MT6000, MT3000, MT2500, AXT1800, and AX1800 4.6.2. By intercepting an HTTP request and changing the filename property in the download interface, any file on the device can be deleted.
Severity
6.5 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2024-10-28 19:31 UTC
CWE
- n/a
- CWE-326 - Inadequate Encryption Strength
Assigner
References
1 reference
Impacted products
6 products
| Vendor | Product | Version | |
|---|---|---|---|
| gl-inet | gl-b3000_firmware |
Affected:
4.5.18 , < 4.5.19
(custom)
cpe:2.3:o:gl-inet:gl-b3000_firmware:*:*:*:*:*:*:*:* |
|
| gl-inet | gl-mt6000_firmware |
Affected:
4.6.2 , < 4.6.4
(custom)
cpe:2.3:o:gl-inet:gl-ax1800_firmware:*:*:*:*:*:*:*:* cpe:2.3:o:gl-inet:gl-axt1800_firmware:-:*:*:*:*:*:*:* cpe:2.3:o:gl-inet:gl-mt2500_firmware:-:*:*:*:*:*:*:* cpe:2.3:o:gl-inet:gl-mt3000_firmware:-:*:*:*:*:*:*:* cpe:2.3:o:gl-inet:gl-mt6000_firmware:*:*:*:*:*:*:*:* |
|
| gl-inet | gl-x300b_firmware |
Affected:
4.5.17 , < 4.5.18
(custom)
cpe:2.3:o:gl-inet:gl-a1300_firmware:-:*:*:*:*:*:*:* cpe:2.3:o:gl-inet:gl-x300b_firmware:-:*:*:*:*:*:*:* |
|
| gl-inet | gl-xe300_firmware |
Affected:
4.4.9 , < 4.4.10
(custom)
cpe:2.3:o:gl-inet:gl-x3000_firmware:-:*:*:*:*:*:*:* cpe:2.3:o:gl-inet:gl-xe300_firmware:-:*:*:*:*:*:*:* |
|
| gl-inet | gl-x750_firmware |
Affected:
4.3.18 , < 4.3.19
(custom)
cpe:2.3:o:gl-inet:gl-mt1300_firmware:-:*:*:*:*:*:*:* cpe:2.3:o:gl-inet:gl-sft1200_firmware:-:*:*:*:*:*:*:* cpe:2.3:o:gl-inet:gl-x750_firmware:-:*:*:*:*:*:*:* |
|
| gl-inet | gl-xe300_firmware |
Affected:
4.3.17 , < 4.3.18
(custom)
cpe:2.3:o:gl-inet:gl-ar300m16_firmware:*:*:*:*:*:*:*:* cpe:2.3:o:gl-inet:gl-ar750_firmware:-:*:*:*:*:*:*:* cpe:2.3:o:gl-inet:gl-ar300m_firmware:-:*:*:*:*:*:*:* cpe:2.3:o:gl-inet:gl-ar750s_firmware:-:*:*:*:*:*:*:* cpe:2.3:o:gl-inet:gl-b1300_firmware:-:*:*:*:*:*:*:* cpe:2.3:o:gl-inet:gl-e750_firmware:-:*:*:*:*:*:*:* cpe:2.3:o:gl-inet:gl-mt300n-v2_firmware:-:*:*:*:*:*:*:* cpe:2.3:o:gl-inet:gl-xe300_firmware:-:*:*:*:*:*:*:* |
{
"containers": {
"adp": [
{
"affected": [
{
"cpes": [
"cpe:2.3:o:gl-inet:gl-b3000_firmware:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "gl-b3000_firmware",
"vendor": "gl-inet",
"versions": [
{
"lessThan": "4.5.19",
"status": "affected",
"version": "4.5.18",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:o:gl-inet:gl-ax1800_firmware:*:*:*:*:*:*:*:*",
"cpe:2.3:o:gl-inet:gl-axt1800_firmware:-:*:*:*:*:*:*:*",
"cpe:2.3:o:gl-inet:gl-mt2500_firmware:-:*:*:*:*:*:*:*",
"cpe:2.3:o:gl-inet:gl-mt3000_firmware:-:*:*:*:*:*:*:*",
"cpe:2.3:o:gl-inet:gl-mt6000_firmware:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "gl-mt6000_firmware",
"vendor": "gl-inet",
"versions": [
{
"lessThan": "4.6.4",
"status": "affected",
"version": "4.6.2",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:o:gl-inet:gl-a1300_firmware:-:*:*:*:*:*:*:*",
"cpe:2.3:o:gl-inet:gl-x300b_firmware:-:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "gl-x300b_firmware",
"vendor": "gl-inet",
"versions": [
{
"lessThan": "4.5.18",
"status": "affected",
"version": "4.5.17",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:o:gl-inet:gl-x3000_firmware:-:*:*:*:*:*:*:*",
"cpe:2.3:o:gl-inet:gl-xe300_firmware:-:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "gl-xe300_firmware",
"vendor": "gl-inet",
"versions": [
{
"lessThan": "4.4.10",
"status": "affected",
"version": "4.4.9",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:o:gl-inet:gl-mt1300_firmware:-:*:*:*:*:*:*:*",
"cpe:2.3:o:gl-inet:gl-sft1200_firmware:-:*:*:*:*:*:*:*",
"cpe:2.3:o:gl-inet:gl-x750_firmware:-:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "gl-x750_firmware",
"vendor": "gl-inet",
"versions": [
{
"lessThan": "4.3.19",
"status": "affected",
"version": "4.3.18",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:o:gl-inet:gl-ar300m16_firmware:*:*:*:*:*:*:*:*",
"cpe:2.3:o:gl-inet:gl-ar750_firmware:-:*:*:*:*:*:*:*",
"cpe:2.3:o:gl-inet:gl-ar300m_firmware:-:*:*:*:*:*:*:*",
"cpe:2.3:o:gl-inet:gl-ar750s_firmware:-:*:*:*:*:*:*:*",
"cpe:2.3:o:gl-inet:gl-b1300_firmware:-:*:*:*:*:*:*:*",
"cpe:2.3:o:gl-inet:gl-e750_firmware:-:*:*:*:*:*:*:*",
"cpe:2.3:o:gl-inet:gl-mt300n-v2_firmware:-:*:*:*:*:*:*:*",
"cpe:2.3:o:gl-inet:gl-xe300_firmware:-:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "gl-xe300_firmware",
"vendor": "gl-inet",
"versions": [
{
"lessThan": "4.3.18",
"status": "affected",
"version": "4.3.17",
"versionType": "custom"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "ADJACENT_NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2024-45259",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-10-28T19:31:51.013958Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-326",
"description": "CWE-326 Inadequate Encryption Strength",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-10-28T19:38:53.728Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "An issue was discovered on certain GL-iNet devices, including MT6000, MT3000, MT2500, AXT1800, and AX1800 4.6.2. By intercepting an HTTP request and changing the filename property in the download interface, any file on the device can be deleted."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-10-24T20:09:41.653Z",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"url": "https://github.com/gl-inet/CVE-issues/blob/main/4.0.0/Delete%20Any%20File%20via%20Download%20Interface.md"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2024-45259",
"datePublished": "2024-10-24T00:00:00.000Z",
"dateReserved": "2024-08-25T00:00:00.000Z",
"dateUpdated": "2024-10-28T19:38:53.728Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2023-31475 (GCVE-0-2023-31475)
Vulnerability from nvd – Published: 2023-05-11 00:00 – Updated: 2025-01-27 17:17
VLAI
EPSS
VEX
Summary
An issue was discovered on GL.iNet devices before 3.216. The function guci2_get() found in libglutil.so has a buffer overflow when an item is requested from a UCI context, and the value is pasted into a char pointer to a buffer without checking the size of the buffer.
Severity
9 (Critical)
SSVC
Exploitation: poc
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2025-01-27 17:16 UTC
CWE
- n/a
- CWE-120 - Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')
Assigner
References
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-02T14:53:30.627Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_transferred"
],
"url": "https://www.gl-inet.com"
},
{
"tags": [
"x_transferred"
],
"url": "https://github.com/gl-inet/CVE-issues/blob/main/3.215/Buffer_Overflow.md"
},
{
"tags": [
"x_transferred"
],
"url": "https://justinapplegate.me/2023/glinet-CVE-2023-31475/"
}
],
"title": "CVE Program Container"
},
{
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2023-31475",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-01-27T17:16:58.373267Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-120",
"description": "CWE-120 Buffer Copy without Checking Size of Input (\u0027Classic Buffer Overflow\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-01-27T17:17:11.696Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "An issue was discovered on GL.iNet devices before 3.216. The function guci2_get() found in libglutil.so has a buffer overflow when an item is requested from a UCI context, and the value is pasted into a char pointer to a buffer without checking the size of the buffer."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2023-06-12T00:00:00.000Z",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"url": "https://www.gl-inet.com"
},
{
"url": "https://github.com/gl-inet/CVE-issues/blob/main/3.215/Buffer_Overflow.md"
},
{
"url": "https://justinapplegate.me/2023/glinet-CVE-2023-31475/"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2023-31475",
"datePublished": "2023-05-11T00:00:00.000Z",
"dateReserved": "2023-04-28T00:00:00.000Z",
"dateUpdated": "2025-01-27T17:17:11.696Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2023-31473 (GCVE-0-2023-31473)
Vulnerability from nvd – Published: 2023-05-11 00:00 – Updated: 2025-01-27 17:18
VLAI
EPSS
VEX
Summary
An issue was discovered on GL.iNet devices before 3.216. There is an arbitrary file write in which an empty file can be created anywhere on the filesystem. This is caused by a command injection vulnerability with a filter applied. Through the software installation feature, it is possible to inject arbitrary parameters in a request to cause opkg to read an arbitrary file name while using root privileges. The -f option can be used with a configuration file.
Severity
4.9 (Medium)
SSVC
Exploitation: poc
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2025-01-27 17:18 UTC
CWE
- n/a
- CWE-77 - Improper Neutralization of Special Elements used in a Command ('Command Injection')
Assigner
References
2 references
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-02T14:53:30.985Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_transferred"
],
"url": "https://www.gl-inet.com"
},
{
"tags": [
"x_transferred"
],
"url": "https://github.com/gl-inet/CVE-issues/blob/main/3.215/Arbitrary_File_Read.md"
}
],
"title": "CVE Program Container"
},
{
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 4.9,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "HIGH",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2023-31473",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-01-27T17:18:19.394710Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-77",
"description": "CWE-77 Improper Neutralization of Special Elements used in a Command (\u0027Command Injection\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-01-27T17:18:23.785Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "An issue was discovered on GL.iNet devices before 3.216. There is an arbitrary file write in which an empty file can be created anywhere on the filesystem. This is caused by a command injection vulnerability with a filter applied. Through the software installation feature, it is possible to inject arbitrary parameters in a request to cause opkg to read an arbitrary file name while using root privileges. The -f option can be used with a configuration file."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2023-05-11T00:00:00.000Z",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"url": "https://www.gl-inet.com"
},
{
"url": "https://github.com/gl-inet/CVE-issues/blob/main/3.215/Arbitrary_File_Read.md"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2023-31473",
"datePublished": "2023-05-11T00:00:00.000Z",
"dateReserved": "2023-04-28T00:00:00.000Z",
"dateUpdated": "2025-01-27T17:18:23.785Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2023-31477 (GCVE-0-2023-31477)
Vulnerability from nvd – Published: 2023-05-11 00:00 – Updated: 2025-01-27 17:15
VLAI
EPSS
VEX
Summary
A path traversal issue was discovered on GL.iNet devices before 3.216. Through the file sharing feature, it is possible to share an arbitrary directory, such as /tmp or /etc, because there is no server-side restriction to limit sharing to the USB path.
Severity
7.5 (High)
SSVC
Exploitation: poc
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2025-01-27 17:15 UTC
CWE
- n/a
- CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Assigner
References
2 references
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-02T14:53:31.074Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_transferred"
],
"url": "https://www.gl-inet.com"
},
{
"tags": [
"x_transferred"
],
"url": "https://github.com/gl-inet/CVE-issues/blob/main/3.215/Path_Traversal.md"
}
],
"title": "CVE Program Container"
},
{
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2023-31477",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-01-27T17:15:20.706586Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-22",
"description": "CWE-22 Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-01-27T17:15:44.508Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "A path traversal issue was discovered on GL.iNet devices before 3.216. Through the file sharing feature, it is possible to share an arbitrary directory, such as /tmp or /etc, because there is no server-side restriction to limit sharing to the USB path."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2023-05-11T00:00:00.000Z",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"url": "https://www.gl-inet.com"
},
{
"url": "https://github.com/gl-inet/CVE-issues/blob/main/3.215/Path_Traversal.md"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2023-31477",
"datePublished": "2023-05-11T00:00:00.000Z",
"dateReserved": "2023-04-28T00:00:00.000Z",
"dateUpdated": "2025-01-27T17:15:44.508Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2023-31471 (GCVE-0-2023-31471)
Vulnerability from nvd – Published: 2023-05-10 00:00 – Updated: 2025-01-27 19:26
VLAI
EPSS
VEX
Summary
An issue was discovered on GL.iNet devices before 3.216. Through the software installation feature, it is possible to install arbitrary software, such as a reverse shell, because the restrictions on the available package list are limited to client-side verification. It is possible to install software from the filesystem, the package list, or a URL.
Severity
9.8 (Critical)
SSVC
Exploitation: poc
Automatable: yes
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2025-01-27 19:26 UTC
Assigner
References
2 references
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-02T14:53:31.075Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_transferred"
],
"url": "https://www.gl-inet.com"
},
{
"tags": [
"x_transferred"
],
"url": "https://github.com/gl-inet/CVE-issues/blob/main/3.215/Abuse_of_Functionality_leads_to_RCE.md"
}
],
"title": "CVE Program Container"
},
{
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2023-31471",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-01-27T19:26:35.960125Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "CWE-noinfo Not enough information",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-01-27T19:26:40.342Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "An issue was discovered on GL.iNet devices before 3.216. Through the software installation feature, it is possible to install arbitrary software, such as a reverse shell, because the restrictions on the available package list are limited to client-side verification. It is possible to install software from the filesystem, the package list, or a URL."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2023-05-10T00:00:00.000Z",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"url": "https://www.gl-inet.com"
},
{
"url": "https://github.com/gl-inet/CVE-issues/blob/main/3.215/Abuse_of_Functionality_leads_to_RCE.md"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2023-31471",
"datePublished": "2023-05-10T00:00:00.000Z",
"dateReserved": "2023-04-28T00:00:00.000Z",
"dateUpdated": "2025-01-27T19:26:40.342Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2023-31478 (GCVE-0-2023-31478)
Vulnerability from nvd – Published: 2023-05-09 00:00 – Updated: 2025-01-29 20:16Summary
An issue was discovered on GL.iNet devices before 3.216. An API endpoint reveals information about the Wi-Fi configuration, including the SSID and key.
Severity
7.5 (High)
SSVC
Exploitation: poc
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2025-01-29 20:15 UTC
Assigner
References
2 references
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-02T14:53:31.026Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_transferred"
],
"url": "https://www.gl-inet.com"
},
{
"tags": [
"x_transferred"
],
"url": "https://github.com/gl-inet/CVE-issues/blob/main/3.215/SSID_Key_Disclosure.md"
}
],
"title": "CVE Program Container"
},
{
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2023-31478",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-01-29T20:15:16.901464Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "CWE-noinfo Not enough information",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-01-29T20:16:30.695Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "An issue was discovered on GL.iNet devices before 3.216. An API endpoint reveals information about the Wi-Fi configuration, including the SSID and key."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2023-05-09T00:00:00.000Z",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"url": "https://www.gl-inet.com"
},
{
"url": "https://github.com/gl-inet/CVE-issues/blob/main/3.215/SSID_Key_Disclosure.md"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2023-31478",
"datePublished": "2023-05-09T00:00:00.000Z",
"dateReserved": "2023-04-28T00:00:00.000Z",
"dateUpdated": "2025-01-29T20:16:30.695Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2023-31474 (GCVE-0-2023-31474)
Vulnerability from nvd – Published: 2023-05-09 00:00 – Updated: 2025-01-29 20:26
VLAI
EPSS
VEX
Summary
An issue was discovered on GL.iNet devices before 3.216. Through the software installation feature, it is possible to inject arbitrary parameters in a request to cause opkg to obtain a list of files in a specific directory, by using the regex feature in a package name.
Severity
7.5 (High)
SSVC
Exploitation: poc
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2025-01-29 20:25 UTC
Assigner
References
2 references
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-02T14:53:30.764Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_transferred"
],
"url": "https://www.gl-inet.com"
},
{
"tags": [
"x_transferred"
],
"url": "https://github.com/gl-inet/CVE-issues/blob/main/3.215/Directory_Listing.md"
}
],
"title": "CVE Program Container"
},
{
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2023-31474",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-01-29T20:25:31.361438Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "CWE-noinfo Not enough information",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-01-29T20:26:33.019Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "An issue was discovered on GL.iNet devices before 3.216. Through the software installation feature, it is possible to inject arbitrary parameters in a request to cause opkg to obtain a list of files in a specific directory, by using the regex feature in a package name."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2023-05-09T00:00:00.000Z",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"url": "https://www.gl-inet.com"
},
{
"url": "https://github.com/gl-inet/CVE-issues/blob/main/3.215/Directory_Listing.md"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2023-31474",
"datePublished": "2023-05-09T00:00:00.000Z",
"dateReserved": "2023-04-28T00:00:00.000Z",
"dateUpdated": "2025-01-29T20:26:33.019Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2023-31472 (GCVE-0-2023-31472)
Vulnerability from nvd – Published: 2023-05-09 00:00 – Updated: 2025-01-29 20:28
VLAI
EPSS
VEX
Summary
An issue was discovered on GL.iNet devices before 3.216. There is an arbitrary file write in which an empty file can be created anywhere on the filesystem. This is caused by a command injection vulnerability with a filter applied.
Severity
7.5 (High)
SSVC
Exploitation: poc
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2025-01-29 20:27 UTC
CWE
- n/a
- CWE-770 - Allocation of Resources Without Limits or Throttling
Assigner
References
2 references
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-02T14:53:31.081Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_transferred"
],
"url": "https://www.gl-inet.com"
},
{
"tags": [
"x_transferred"
],
"url": "https://github.com/gl-inet/CVE-issues/blob/main/3.215/Arbitrary_File_Creation.md"
}
],
"title": "CVE Program Container"
},
{
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2023-31472",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-01-29T20:27:18.006885Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-770",
"description": "CWE-770 Allocation of Resources Without Limits or Throttling",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-01-29T20:28:12.263Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "An issue was discovered on GL.iNet devices before 3.216. There is an arbitrary file write in which an empty file can be created anywhere on the filesystem. This is caused by a command injection vulnerability with a filter applied."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2023-05-09T00:00:00.000Z",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"url": "https://www.gl-inet.com"
},
{
"url": "https://github.com/gl-inet/CVE-issues/blob/main/3.215/Arbitrary_File_Creation.md"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2023-31472",
"datePublished": "2023-05-09T00:00:00.000Z",
"dateReserved": "2023-04-28T00:00:00.000Z",
"dateUpdated": "2025-01-29T20:28:12.263Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2024-45263 (GCVE-0-2024-45263)
Vulnerability from cvelistv5 – Published: 2024-10-24 00:00 – Updated: 2024-10-28 18:52
VLAI
EPSS
VEX
Summary
An issue was discovered on certain GL-iNet devices, including MT6000, MT3000, MT2500, AXT1800, and AX1800 4.6.2. The upload interface allows the uploading of arbitrary files to the device. Once the device executes the files, it can lead to information leakage, enabling complete control.
Severity
8.8 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2024-10-28 18:34 UTC
CWE
- n/a
- CWE-434 - Unrestricted Upload of File with Dangerous Type
Assigner
References
1 reference
Impacted products
6 products
| Vendor | Product | Version | |
|---|---|---|---|
| gl-inet | gl-b3000_firmware |
Affected:
4.5.18 , < 4.5.19
(custom)
cpe:2.3:o:gl-inet:gl-b3000_firmware:*:*:*:*:*:*:*:* |
|
| gl-inet | gl-mt6000_firmware |
Affected:
4.6.2 , < 4.6.4
(custom)
cpe:2.3:o:gl-inet:gl-ax1800_firmware:*:*:*:*:*:*:*:* cpe:2.3:o:gl-inet:gl-axt1800_firmware:-:*:*:*:*:*:*:* cpe:2.3:o:gl-inet:gl-mt2500_firmware:-:*:*:*:*:*:*:* cpe:2.3:o:gl-inet:gl-mt3000_firmware:-:*:*:*:*:*:*:* cpe:2.3:o:gl-inet:gl-mt6000_firmware:*:*:*:*:*:*:*:* |
|
| gl-inet | gl-x300b_firmware |
Affected:
4.5.17 , < 4.5.18
(custom)
cpe:2.3:o:gl-inet:gl-a1300_firmware:-:*:*:*:*:*:*:* cpe:2.3:o:gl-inet:gl-x300b_firmware:-:*:*:*:*:*:*:* |
|
| gl-inet | gl-xe300_firmware |
Affected:
4.4.9 , < 4.4.10
(custom)
cpe:2.3:o:gl-inet:gl-x3000_firmware:-:*:*:*:*:*:*:* cpe:2.3:o:gl-inet:gl-xe300_firmware:-:*:*:*:*:*:*:* |
|
| gl-inet | gl-x750_firmware |
Affected:
4.3.18 , < 4.3.19
(custom)
cpe:2.3:o:gl-inet:gl-mt1300_firmware:-:*:*:*:*:*:*:* cpe:2.3:o:gl-inet:gl-sft1200_firmware:-:*:*:*:*:*:*:* cpe:2.3:o:gl-inet:gl-x750_firmware:-:*:*:*:*:*:*:* |
|
| gl-inet | gl-xe300_firmware |
Affected:
4.3.17 , < 4.3.18
(custom)
cpe:2.3:o:gl-inet:gl-ar300m16_firmware:*:*:*:*:*:*:*:* cpe:2.3:o:gl-inet:gl-ar750_firmware:-:*:*:*:*:*:*:* cpe:2.3:o:gl-inet:gl-ar300m_firmware:-:*:*:*:*:*:*:* cpe:2.3:o:gl-inet:gl-ar750s_firmware:-:*:*:*:*:*:*:* cpe:2.3:o:gl-inet:gl-b1300_firmware:-:*:*:*:*:*:*:* cpe:2.3:o:gl-inet:gl-e750_firmware:-:*:*:*:*:*:*:* cpe:2.3:o:gl-inet:gl-mt300n-v2_firmware:-:*:*:*:*:*:*:* cpe:2.3:o:gl-inet:gl-xe300_firmware:-:*:*:*:*:*:*:* |
{
"containers": {
"adp": [
{
"affected": [
{
"cpes": [
"cpe:2.3:o:gl-inet:gl-b3000_firmware:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "gl-b3000_firmware",
"vendor": "gl-inet",
"versions": [
{
"lessThan": "4.5.19",
"status": "affected",
"version": "4.5.18",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:o:gl-inet:gl-ax1800_firmware:*:*:*:*:*:*:*:*",
"cpe:2.3:o:gl-inet:gl-axt1800_firmware:-:*:*:*:*:*:*:*",
"cpe:2.3:o:gl-inet:gl-mt2500_firmware:-:*:*:*:*:*:*:*",
"cpe:2.3:o:gl-inet:gl-mt3000_firmware:-:*:*:*:*:*:*:*",
"cpe:2.3:o:gl-inet:gl-mt6000_firmware:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "gl-mt6000_firmware",
"vendor": "gl-inet",
"versions": [
{
"lessThan": "4.6.4",
"status": "affected",
"version": "4.6.2",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:o:gl-inet:gl-a1300_firmware:-:*:*:*:*:*:*:*",
"cpe:2.3:o:gl-inet:gl-x300b_firmware:-:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "gl-x300b_firmware",
"vendor": "gl-inet",
"versions": [
{
"lessThan": "4.5.18",
"status": "affected",
"version": "4.5.17",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:o:gl-inet:gl-x3000_firmware:-:*:*:*:*:*:*:*",
"cpe:2.3:o:gl-inet:gl-xe300_firmware:-:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "gl-xe300_firmware",
"vendor": "gl-inet",
"versions": [
{
"lessThan": "4.4.10",
"status": "affected",
"version": "4.4.9",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:o:gl-inet:gl-mt1300_firmware:-:*:*:*:*:*:*:*",
"cpe:2.3:o:gl-inet:gl-sft1200_firmware:-:*:*:*:*:*:*:*",
"cpe:2.3:o:gl-inet:gl-x750_firmware:-:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "gl-x750_firmware",
"vendor": "gl-inet",
"versions": [
{
"lessThan": "4.3.19",
"status": "affected",
"version": "4.3.18",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:o:gl-inet:gl-ar300m16_firmware:*:*:*:*:*:*:*:*",
"cpe:2.3:o:gl-inet:gl-ar750_firmware:-:*:*:*:*:*:*:*",
"cpe:2.3:o:gl-inet:gl-ar300m_firmware:-:*:*:*:*:*:*:*",
"cpe:2.3:o:gl-inet:gl-ar750s_firmware:-:*:*:*:*:*:*:*",
"cpe:2.3:o:gl-inet:gl-b1300_firmware:-:*:*:*:*:*:*:*",
"cpe:2.3:o:gl-inet:gl-e750_firmware:-:*:*:*:*:*:*:*",
"cpe:2.3:o:gl-inet:gl-mt300n-v2_firmware:-:*:*:*:*:*:*:*",
"cpe:2.3:o:gl-inet:gl-xe300_firmware:-:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "gl-xe300_firmware",
"vendor": "gl-inet",
"versions": [
{
"lessThan": "4.3.18",
"status": "affected",
"version": "4.3.17",
"versionType": "custom"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "ADJACENT_NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2024-45263",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-10-28T18:34:32.730872Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-434",
"description": "CWE-434 Unrestricted Upload of File with Dangerous Type",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-10-28T18:52:30.245Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "An issue was discovered on certain GL-iNet devices, including MT6000, MT3000, MT2500, AXT1800, and AX1800 4.6.2. The upload interface allows the uploading of arbitrary files to the device. Once the device executes the files, it can lead to information leakage, enabling complete control."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-10-24T20:21:28.712Z",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"url": "https://github.com/gl-inet/CVE-issues/blob/main/4.0.0/Arbitrary%20File%20Upload%20to%20ovpn_upload%20via%20Upload%20Interface.md"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2024-45263",
"datePublished": "2024-10-24T00:00:00.000Z",
"dateReserved": "2024-08-25T00:00:00.000Z",
"dateUpdated": "2024-10-28T18:52:30.245Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2024-45261 (GCVE-0-2024-45261)
Vulnerability from cvelistv5 – Published: 2024-10-24 00:00 – Updated: 2024-10-28 19:19
VLAI
EPSS
VEX
Summary
An issue was discovered on certain GL-iNet devices, including MT6000, MT3000, MT2500, AXT1800, and AX1800 4.6.2. The SID generated for a specific user is not tied to that user itself, which allows other users to potentially use it for authentication. Once an attacker bypasses the application's authentication procedures, they can generate a valid SID, escalate privileges, and gain full control.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2024-10-28 19:12 UTC
CWE
- n/a
- CWE-863 - Incorrect Authorization
Assigner
References
1 reference
Impacted products
6 products
| Vendor | Product | Version | |
|---|---|---|---|
| gl-inet | gl-b3000_firmware |
Affected:
4.5.18 , < 4.5.19
(custom)
cpe:2.3:o:gl-inet:gl-b3000_firmware:*:*:*:*:*:*:*:* |
|
| gl-inet | gl-mt6000_firmware |
Affected:
4.6.2 , < 4.6.4
(custom)
cpe:2.3:o:gl-inet:gl-ax1800_firmware:*:*:*:*:*:*:*:* cpe:2.3:o:gl-inet:gl-axt1800_firmware:-:*:*:*:*:*:*:* cpe:2.3:o:gl-inet:gl-mt2500_firmware:-:*:*:*:*:*:*:* cpe:2.3:o:gl-inet:gl-mt3000_firmware:-:*:*:*:*:*:*:* cpe:2.3:o:gl-inet:gl-mt6000_firmware:*:*:*:*:*:*:*:* |
|
| gl-inet | gl-x300b_firmware |
Affected:
4.5.17 , < 4.5.18
(custom)
cpe:2.3:o:gl-inet:gl-a1300_firmware:-:*:*:*:*:*:*:* cpe:2.3:o:gl-inet:gl-x300b_firmware:-:*:*:*:*:*:*:* |
|
| gl-inet | gl-xe300_firmware |
Affected:
4.4.9 , < 4.4.10
(custom)
cpe:2.3:o:gl-inet:gl-x3000_firmware:-:*:*:*:*:*:*:* cpe:2.3:o:gl-inet:gl-xe300_firmware:-:*:*:*:*:*:*:* |
|
| gl-inet | gl-x750_firmware |
Affected:
4.3.18 , < 4.3.19
(custom)
cpe:2.3:o:gl-inet:gl-mt1300_firmware:-:*:*:*:*:*:*:* cpe:2.3:o:gl-inet:gl-sft1200_firmware:-:*:*:*:*:*:*:* cpe:2.3:o:gl-inet:gl-x750_firmware:-:*:*:*:*:*:*:* |
|
| gl-inet | gl-xe300_firmware |
Affected:
4.3.17 , < 4.3.18
(custom)
cpe:2.3:o:gl-inet:gl-ar300m16_firmware:*:*:*:*:*:*:*:* cpe:2.3:o:gl-inet:gl-ar750_firmware:-:*:*:*:*:*:*:* cpe:2.3:o:gl-inet:gl-ar300m_firmware:-:*:*:*:*:*:*:* cpe:2.3:o:gl-inet:gl-ar750s_firmware:-:*:*:*:*:*:*:* cpe:2.3:o:gl-inet:gl-b1300_firmware:-:*:*:*:*:*:*:* cpe:2.3:o:gl-inet:gl-e750_firmware:-:*:*:*:*:*:*:* cpe:2.3:o:gl-inet:gl-mt300n-v2_firmware:-:*:*:*:*:*:*:* cpe:2.3:o:gl-inet:gl-xe300_firmware:-:*:*:*:*:*:*:* |
{
"containers": {
"adp": [
{
"affected": [
{
"cpes": [
"cpe:2.3:o:gl-inet:gl-b3000_firmware:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "gl-b3000_firmware",
"vendor": "gl-inet",
"versions": [
{
"lessThan": "4.5.19",
"status": "affected",
"version": "4.5.18",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:o:gl-inet:gl-ax1800_firmware:*:*:*:*:*:*:*:*",
"cpe:2.3:o:gl-inet:gl-axt1800_firmware:-:*:*:*:*:*:*:*",
"cpe:2.3:o:gl-inet:gl-mt2500_firmware:-:*:*:*:*:*:*:*",
"cpe:2.3:o:gl-inet:gl-mt3000_firmware:-:*:*:*:*:*:*:*",
"cpe:2.3:o:gl-inet:gl-mt6000_firmware:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "gl-mt6000_firmware",
"vendor": "gl-inet",
"versions": [
{
"lessThan": "4.6.4",
"status": "affected",
"version": "4.6.2",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:o:gl-inet:gl-a1300_firmware:-:*:*:*:*:*:*:*",
"cpe:2.3:o:gl-inet:gl-x300b_firmware:-:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "gl-x300b_firmware",
"vendor": "gl-inet",
"versions": [
{
"lessThan": "4.5.18",
"status": "affected",
"version": "4.5.17",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:o:gl-inet:gl-x3000_firmware:-:*:*:*:*:*:*:*",
"cpe:2.3:o:gl-inet:gl-xe300_firmware:-:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "gl-xe300_firmware",
"vendor": "gl-inet",
"versions": [
{
"lessThan": "4.4.10",
"status": "affected",
"version": "4.4.9",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:o:gl-inet:gl-mt1300_firmware:-:*:*:*:*:*:*:*",
"cpe:2.3:o:gl-inet:gl-sft1200_firmware:-:*:*:*:*:*:*:*",
"cpe:2.3:o:gl-inet:gl-x750_firmware:-:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "gl-x750_firmware",
"vendor": "gl-inet",
"versions": [
{
"lessThan": "4.3.19",
"status": "affected",
"version": "4.3.18",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:o:gl-inet:gl-ar300m16_firmware:*:*:*:*:*:*:*:*",
"cpe:2.3:o:gl-inet:gl-ar750_firmware:-:*:*:*:*:*:*:*",
"cpe:2.3:o:gl-inet:gl-ar300m_firmware:-:*:*:*:*:*:*:*",
"cpe:2.3:o:gl-inet:gl-ar750s_firmware:-:*:*:*:*:*:*:*",
"cpe:2.3:o:gl-inet:gl-b1300_firmware:-:*:*:*:*:*:*:*",
"cpe:2.3:o:gl-inet:gl-e750_firmware:-:*:*:*:*:*:*:*",
"cpe:2.3:o:gl-inet:gl-mt300n-v2_firmware:-:*:*:*:*:*:*:*",
"cpe:2.3:o:gl-inet:gl-xe300_firmware:-:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "gl-xe300_firmware",
"vendor": "gl-inet",
"versions": [
{
"lessThan": "4.3.18",
"status": "affected",
"version": "4.3.17",
"versionType": "custom"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "ADJACENT_NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2024-45261",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-10-28T19:12:05.989024Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-863",
"description": "CWE-863 Incorrect Authorization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-10-28T19:19:59.290Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "An issue was discovered on certain GL-iNet devices, including MT6000, MT3000, MT2500, AXT1800, and AX1800 4.6.2. The SID generated for a specific user is not tied to that user itself, which allows other users to potentially use it for authentication. Once an attacker bypasses the application\u0027s authentication procedures, they can generate a valid SID, escalate privileges, and gain full control."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-10-24T20:18:25.796Z",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"url": "https://github.com/gl-inet/CVE-issues/blob/main/4.0.0/Bypassing%20Login%20Mechanism%20with%20Passwordless%20User%20Login.md"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2024-45261",
"datePublished": "2024-10-24T00:00:00.000Z",
"dateReserved": "2024-08-25T00:00:00.000Z",
"dateUpdated": "2024-10-28T19:19:59.290Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2024-45262 (GCVE-0-2024-45262)
Vulnerability from cvelistv5 – Published: 2024-10-24 00:00 – Updated: 2024-10-28 19:22
VLAI
EPSS
VEX
Summary
An issue was discovered on certain GL-iNet devices, including MT6000, MT3000, MT2500, AXT1800, and AX1800 4.6.2. The params parameter in the call method of the /rpc endpoint is vulnerable to arbitrary directory traversal, which enables attackers to execute scripts under any path.
Severity
8.8 (High)
SSVC
Exploitation: poc
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2024-10-28 19:21 UTC
CWE
- n/a
- CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Assigner
References
1 reference
Impacted products
6 products
| Vendor | Product | Version | |
|---|---|---|---|
| gl-inet | gl-b3000_firmware |
Affected:
4.5.18 , < 4.5.19
(custom)
cpe:2.3:o:gl-inet:gl-b3000_firmware:*:*:*:*:*:*:*:* |
|
| gl-inet | gl-mt6000_firmware |
Affected:
4.6.2 , < 4.6.4
(custom)
cpe:2.3:o:gl-inet:gl-ax1800_firmware:*:*:*:*:*:*:*:* cpe:2.3:o:gl-inet:gl-axt1800_firmware:-:*:*:*:*:*:*:* cpe:2.3:o:gl-inet:gl-mt2500_firmware:-:*:*:*:*:*:*:* cpe:2.3:o:gl-inet:gl-mt3000_firmware:-:*:*:*:*:*:*:* cpe:2.3:o:gl-inet:gl-mt6000_firmware:*:*:*:*:*:*:*:* |
|
| gl-inet | gl-x300b_firmware |
Affected:
4.5.17 , < 4.5.18
(custom)
cpe:2.3:o:gl-inet:gl-a1300_firmware:-:*:*:*:*:*:*:* cpe:2.3:o:gl-inet:gl-x300b_firmware:-:*:*:*:*:*:*:* |
|
| gl-inet | gl-xe300_firmware |
Affected:
4.4.9 , < 4.4.10
(custom)
cpe:2.3:o:gl-inet:gl-x3000_firmware:-:*:*:*:*:*:*:* cpe:2.3:o:gl-inet:gl-xe300_firmware:-:*:*:*:*:*:*:* |
|
| gl-inet | gl-x750_firmware |
Affected:
4.3.18 , < 4.3.19
(custom)
cpe:2.3:o:gl-inet:gl-mt1300_firmware:-:*:*:*:*:*:*:* cpe:2.3:o:gl-inet:gl-sft1200_firmware:-:*:*:*:*:*:*:* cpe:2.3:o:gl-inet:gl-x750_firmware:-:*:*:*:*:*:*:* |
|
| gl-inet | gl-xe300_firmware |
Affected:
4.3.17 , < 4.3.18
(custom)
cpe:2.3:o:gl-inet:gl-ar300m16_firmware:*:*:*:*:*:*:*:* cpe:2.3:o:gl-inet:gl-ar750_firmware:-:*:*:*:*:*:*:* cpe:2.3:o:gl-inet:gl-ar300m_firmware:-:*:*:*:*:*:*:* cpe:2.3:o:gl-inet:gl-ar750s_firmware:-:*:*:*:*:*:*:* cpe:2.3:o:gl-inet:gl-b1300_firmware:-:*:*:*:*:*:*:* cpe:2.3:o:gl-inet:gl-e750_firmware:-:*:*:*:*:*:*:* cpe:2.3:o:gl-inet:gl-mt300n-v2_firmware:-:*:*:*:*:*:*:* cpe:2.3:o:gl-inet:gl-xe300_firmware:-:*:*:*:*:*:*:* |
{
"containers": {
"adp": [
{
"affected": [
{
"cpes": [
"cpe:2.3:o:gl-inet:gl-b3000_firmware:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "gl-b3000_firmware",
"vendor": "gl-inet",
"versions": [
{
"lessThan": "4.5.19",
"status": "affected",
"version": "4.5.18",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:o:gl-inet:gl-ax1800_firmware:*:*:*:*:*:*:*:*",
"cpe:2.3:o:gl-inet:gl-axt1800_firmware:-:*:*:*:*:*:*:*",
"cpe:2.3:o:gl-inet:gl-mt2500_firmware:-:*:*:*:*:*:*:*",
"cpe:2.3:o:gl-inet:gl-mt3000_firmware:-:*:*:*:*:*:*:*",
"cpe:2.3:o:gl-inet:gl-mt6000_firmware:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "gl-mt6000_firmware",
"vendor": "gl-inet",
"versions": [
{
"lessThan": "4.6.4",
"status": "affected",
"version": "4.6.2",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:o:gl-inet:gl-a1300_firmware:-:*:*:*:*:*:*:*",
"cpe:2.3:o:gl-inet:gl-x300b_firmware:-:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "gl-x300b_firmware",
"vendor": "gl-inet",
"versions": [
{
"lessThan": "4.5.18",
"status": "affected",
"version": "4.5.17",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:o:gl-inet:gl-x3000_firmware:-:*:*:*:*:*:*:*",
"cpe:2.3:o:gl-inet:gl-xe300_firmware:-:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "gl-xe300_firmware",
"vendor": "gl-inet",
"versions": [
{
"lessThan": "4.4.10",
"status": "affected",
"version": "4.4.9",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:o:gl-inet:gl-mt1300_firmware:-:*:*:*:*:*:*:*",
"cpe:2.3:o:gl-inet:gl-sft1200_firmware:-:*:*:*:*:*:*:*",
"cpe:2.3:o:gl-inet:gl-x750_firmware:-:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "gl-x750_firmware",
"vendor": "gl-inet",
"versions": [
{
"lessThan": "4.3.19",
"status": "affected",
"version": "4.3.18",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:o:gl-inet:gl-ar300m16_firmware:*:*:*:*:*:*:*:*",
"cpe:2.3:o:gl-inet:gl-ar750_firmware:-:*:*:*:*:*:*:*",
"cpe:2.3:o:gl-inet:gl-ar300m_firmware:-:*:*:*:*:*:*:*",
"cpe:2.3:o:gl-inet:gl-ar750s_firmware:-:*:*:*:*:*:*:*",
"cpe:2.3:o:gl-inet:gl-b1300_firmware:-:*:*:*:*:*:*:*",
"cpe:2.3:o:gl-inet:gl-e750_firmware:-:*:*:*:*:*:*:*",
"cpe:2.3:o:gl-inet:gl-mt300n-v2_firmware:-:*:*:*:*:*:*:*",
"cpe:2.3:o:gl-inet:gl-xe300_firmware:-:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "gl-xe300_firmware",
"vendor": "gl-inet",
"versions": [
{
"lessThan": "4.3.18",
"status": "affected",
"version": "4.3.17",
"versionType": "custom"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "ADJACENT_NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2024-45262",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-10-28T19:21:47.832625Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-22",
"description": "CWE-22 Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-10-28T19:22:25.505Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "An issue was discovered on certain GL-iNet devices, including MT6000, MT3000, MT2500, AXT1800, and AX1800 4.6.2. The params parameter in the call method of the /rpc endpoint is vulnerable to arbitrary directory traversal, which enables attackers to execute scripts under any path."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-10-24T20:19:54.001Z",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"url": "https://github.com/gl-inet/CVE-issues/blob/main/4.0.0/Improper%20Pathname%20Restriction%20Leading%20to%20Path%20Traversal%20in%20Restricted%20Directories.md"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2024-45262",
"datePublished": "2024-10-24T00:00:00.000Z",
"dateReserved": "2024-08-25T00:00:00.000Z",
"dateUpdated": "2024-10-28T19:22:25.505Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2024-45260 (GCVE-0-2024-45260)
Vulnerability from cvelistv5 – Published: 2024-10-24 00:00 – Updated: 2024-10-28 19:27
VLAI
EPSS
VEX
Summary
An issue was discovered on certain GL-iNet devices, including MT6000, MT3000, MT2500, AXT1800, and AX1800 4.6.2. Users who belong to unauthorized groups can invoke any interface of the device, thereby gaining complete control over it.
Severity
SSVC
Exploitation: poc
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2024-10-28 19:24 UTC
CWE
- n/a
- CWE-863 - Incorrect Authorization
Assigner
References
1 reference
Impacted products
6 products
| Vendor | Product | Version | |
|---|---|---|---|
| gl-inet | gl-b3000_firmware |
Affected:
4.5.18 , < 4.5.19
(custom)
cpe:2.3:o:gl-inet:gl-b3000_firmware:*:*:*:*:*:*:*:* |
|
| gl-inet | gl-mt6000_firmware |
Affected:
4.6.2 , < 4.6.4
(custom)
cpe:2.3:o:gl-inet:gl-ax1800_firmware:*:*:*:*:*:*:*:* cpe:2.3:o:gl-inet:gl-axt1800_firmware:-:*:*:*:*:*:*:* cpe:2.3:o:gl-inet:gl-mt2500_firmware:-:*:*:*:*:*:*:* cpe:2.3:o:gl-inet:gl-mt3000_firmware:-:*:*:*:*:*:*:* cpe:2.3:o:gl-inet:gl-mt6000_firmware:*:*:*:*:*:*:*:* |
|
| gl-inet | gl-x300b_firmware |
Affected:
4.5.17 , < 4.5.18
(custom)
cpe:2.3:o:gl-inet:gl-a1300_firmware:-:*:*:*:*:*:*:* cpe:2.3:o:gl-inet:gl-x300b_firmware:-:*:*:*:*:*:*:* |
|
| gl-inet | gl-xe300_firmware |
Affected:
4.4.9 , < 4.4.10
(custom)
cpe:2.3:o:gl-inet:gl-x3000_firmware:-:*:*:*:*:*:*:* cpe:2.3:o:gl-inet:gl-xe300_firmware:-:*:*:*:*:*:*:* |
|
| gl-inet | gl-x750_firmware |
Affected:
4.3.18 , < 4.3.19
(custom)
cpe:2.3:o:gl-inet:gl-mt1300_firmware:-:*:*:*:*:*:*:* cpe:2.3:o:gl-inet:gl-sft1200_firmware:-:*:*:*:*:*:*:* cpe:2.3:o:gl-inet:gl-x750_firmware:-:*:*:*:*:*:*:* |
|
| gl-inet | gl-xe300_firmware |
Affected:
4.3.17 , < 4.3.18
(custom)
cpe:2.3:o:gl-inet:gl-ar300m16_firmware:*:*:*:*:*:*:*:* cpe:2.3:o:gl-inet:gl-ar750_firmware:-:*:*:*:*:*:*:* cpe:2.3:o:gl-inet:gl-ar300m_firmware:-:*:*:*:*:*:*:* cpe:2.3:o:gl-inet:gl-ar750s_firmware:-:*:*:*:*:*:*:* cpe:2.3:o:gl-inet:gl-b1300_firmware:-:*:*:*:*:*:*:* cpe:2.3:o:gl-inet:gl-e750_firmware:-:*:*:*:*:*:*:* cpe:2.3:o:gl-inet:gl-mt300n-v2_firmware:-:*:*:*:*:*:*:* cpe:2.3:o:gl-inet:gl-xe300_firmware:-:*:*:*:*:*:*:* |
{
"containers": {
"adp": [
{
"affected": [
{
"cpes": [
"cpe:2.3:o:gl-inet:gl-b3000_firmware:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "gl-b3000_firmware",
"vendor": "gl-inet",
"versions": [
{
"lessThan": "4.5.19",
"status": "affected",
"version": "4.5.18",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:o:gl-inet:gl-ax1800_firmware:*:*:*:*:*:*:*:*",
"cpe:2.3:o:gl-inet:gl-axt1800_firmware:-:*:*:*:*:*:*:*",
"cpe:2.3:o:gl-inet:gl-mt2500_firmware:-:*:*:*:*:*:*:*",
"cpe:2.3:o:gl-inet:gl-mt3000_firmware:-:*:*:*:*:*:*:*",
"cpe:2.3:o:gl-inet:gl-mt6000_firmware:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "gl-mt6000_firmware",
"vendor": "gl-inet",
"versions": [
{
"lessThan": "4.6.4",
"status": "affected",
"version": "4.6.2",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:o:gl-inet:gl-a1300_firmware:-:*:*:*:*:*:*:*",
"cpe:2.3:o:gl-inet:gl-x300b_firmware:-:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "gl-x300b_firmware",
"vendor": "gl-inet",
"versions": [
{
"lessThan": "4.5.18",
"status": "affected",
"version": "4.5.17",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:o:gl-inet:gl-x3000_firmware:-:*:*:*:*:*:*:*",
"cpe:2.3:o:gl-inet:gl-xe300_firmware:-:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "gl-xe300_firmware",
"vendor": "gl-inet",
"versions": [
{
"lessThan": "4.4.10",
"status": "affected",
"version": "4.4.9",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:o:gl-inet:gl-mt1300_firmware:-:*:*:*:*:*:*:*",
"cpe:2.3:o:gl-inet:gl-sft1200_firmware:-:*:*:*:*:*:*:*",
"cpe:2.3:o:gl-inet:gl-x750_firmware:-:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "gl-x750_firmware",
"vendor": "gl-inet",
"versions": [
{
"lessThan": "4.3.19",
"status": "affected",
"version": "4.3.18",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:o:gl-inet:gl-ar300m16_firmware:*:*:*:*:*:*:*:*",
"cpe:2.3:o:gl-inet:gl-ar750_firmware:-:*:*:*:*:*:*:*",
"cpe:2.3:o:gl-inet:gl-ar300m_firmware:-:*:*:*:*:*:*:*",
"cpe:2.3:o:gl-inet:gl-ar750s_firmware:-:*:*:*:*:*:*:*",
"cpe:2.3:o:gl-inet:gl-b1300_firmware:-:*:*:*:*:*:*:*",
"cpe:2.3:o:gl-inet:gl-e750_firmware:-:*:*:*:*:*:*:*",
"cpe:2.3:o:gl-inet:gl-mt300n-v2_firmware:-:*:*:*:*:*:*:*",
"cpe:2.3:o:gl-inet:gl-xe300_firmware:-:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "gl-xe300_firmware",
"vendor": "gl-inet",
"versions": [
{
"lessThan": "4.3.18",
"status": "affected",
"version": "4.3.17",
"versionType": "custom"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "ADJACENT_NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2024-45260",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-10-28T19:24:33.863289Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-863",
"description": "CWE-863 Incorrect Authorization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-10-28T19:27:01.398Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "An issue was discovered on certain GL-iNet devices, including MT6000, MT3000, MT2500, AXT1800, and AX1800 4.6.2. Users who belong to unauthorized groups can invoke any interface of the device, thereby gaining complete control over it."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-10-24T20:11:10.715Z",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"url": "https://github.com/gl-inet/CVE-issues/blob/main/4.0.0/Unauthorized%20Access%20to%20File%20Download%20and%20Upload%20Interfaces.md"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2024-45260",
"datePublished": "2024-10-24T00:00:00.000Z",
"dateReserved": "2024-08-25T00:00:00.000Z",
"dateUpdated": "2024-10-28T19:27:01.398Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2024-45259 (GCVE-0-2024-45259)
Vulnerability from cvelistv5 – Published: 2024-10-24 00:00 – Updated: 2024-10-28 19:38
VLAI
EPSS
VEX
Summary
An issue was discovered on certain GL-iNet devices, including MT6000, MT3000, MT2500, AXT1800, and AX1800 4.6.2. By intercepting an HTTP request and changing the filename property in the download interface, any file on the device can be deleted.
Severity
6.5 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2024-10-28 19:31 UTC
CWE
- n/a
- CWE-326 - Inadequate Encryption Strength
Assigner
References
1 reference
Impacted products
6 products
| Vendor | Product | Version | |
|---|---|---|---|
| gl-inet | gl-b3000_firmware |
Affected:
4.5.18 , < 4.5.19
(custom)
cpe:2.3:o:gl-inet:gl-b3000_firmware:*:*:*:*:*:*:*:* |
|
| gl-inet | gl-mt6000_firmware |
Affected:
4.6.2 , < 4.6.4
(custom)
cpe:2.3:o:gl-inet:gl-ax1800_firmware:*:*:*:*:*:*:*:* cpe:2.3:o:gl-inet:gl-axt1800_firmware:-:*:*:*:*:*:*:* cpe:2.3:o:gl-inet:gl-mt2500_firmware:-:*:*:*:*:*:*:* cpe:2.3:o:gl-inet:gl-mt3000_firmware:-:*:*:*:*:*:*:* cpe:2.3:o:gl-inet:gl-mt6000_firmware:*:*:*:*:*:*:*:* |
|
| gl-inet | gl-x300b_firmware |
Affected:
4.5.17 , < 4.5.18
(custom)
cpe:2.3:o:gl-inet:gl-a1300_firmware:-:*:*:*:*:*:*:* cpe:2.3:o:gl-inet:gl-x300b_firmware:-:*:*:*:*:*:*:* |
|
| gl-inet | gl-xe300_firmware |
Affected:
4.4.9 , < 4.4.10
(custom)
cpe:2.3:o:gl-inet:gl-x3000_firmware:-:*:*:*:*:*:*:* cpe:2.3:o:gl-inet:gl-xe300_firmware:-:*:*:*:*:*:*:* |
|
| gl-inet | gl-x750_firmware |
Affected:
4.3.18 , < 4.3.19
(custom)
cpe:2.3:o:gl-inet:gl-mt1300_firmware:-:*:*:*:*:*:*:* cpe:2.3:o:gl-inet:gl-sft1200_firmware:-:*:*:*:*:*:*:* cpe:2.3:o:gl-inet:gl-x750_firmware:-:*:*:*:*:*:*:* |
|
| gl-inet | gl-xe300_firmware |
Affected:
4.3.17 , < 4.3.18
(custom)
cpe:2.3:o:gl-inet:gl-ar300m16_firmware:*:*:*:*:*:*:*:* cpe:2.3:o:gl-inet:gl-ar750_firmware:-:*:*:*:*:*:*:* cpe:2.3:o:gl-inet:gl-ar300m_firmware:-:*:*:*:*:*:*:* cpe:2.3:o:gl-inet:gl-ar750s_firmware:-:*:*:*:*:*:*:* cpe:2.3:o:gl-inet:gl-b1300_firmware:-:*:*:*:*:*:*:* cpe:2.3:o:gl-inet:gl-e750_firmware:-:*:*:*:*:*:*:* cpe:2.3:o:gl-inet:gl-mt300n-v2_firmware:-:*:*:*:*:*:*:* cpe:2.3:o:gl-inet:gl-xe300_firmware:-:*:*:*:*:*:*:* |
{
"containers": {
"adp": [
{
"affected": [
{
"cpes": [
"cpe:2.3:o:gl-inet:gl-b3000_firmware:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "gl-b3000_firmware",
"vendor": "gl-inet",
"versions": [
{
"lessThan": "4.5.19",
"status": "affected",
"version": "4.5.18",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:o:gl-inet:gl-ax1800_firmware:*:*:*:*:*:*:*:*",
"cpe:2.3:o:gl-inet:gl-axt1800_firmware:-:*:*:*:*:*:*:*",
"cpe:2.3:o:gl-inet:gl-mt2500_firmware:-:*:*:*:*:*:*:*",
"cpe:2.3:o:gl-inet:gl-mt3000_firmware:-:*:*:*:*:*:*:*",
"cpe:2.3:o:gl-inet:gl-mt6000_firmware:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "gl-mt6000_firmware",
"vendor": "gl-inet",
"versions": [
{
"lessThan": "4.6.4",
"status": "affected",
"version": "4.6.2",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:o:gl-inet:gl-a1300_firmware:-:*:*:*:*:*:*:*",
"cpe:2.3:o:gl-inet:gl-x300b_firmware:-:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "gl-x300b_firmware",
"vendor": "gl-inet",
"versions": [
{
"lessThan": "4.5.18",
"status": "affected",
"version": "4.5.17",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:o:gl-inet:gl-x3000_firmware:-:*:*:*:*:*:*:*",
"cpe:2.3:o:gl-inet:gl-xe300_firmware:-:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "gl-xe300_firmware",
"vendor": "gl-inet",
"versions": [
{
"lessThan": "4.4.10",
"status": "affected",
"version": "4.4.9",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:o:gl-inet:gl-mt1300_firmware:-:*:*:*:*:*:*:*",
"cpe:2.3:o:gl-inet:gl-sft1200_firmware:-:*:*:*:*:*:*:*",
"cpe:2.3:o:gl-inet:gl-x750_firmware:-:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "gl-x750_firmware",
"vendor": "gl-inet",
"versions": [
{
"lessThan": "4.3.19",
"status": "affected",
"version": "4.3.18",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:o:gl-inet:gl-ar300m16_firmware:*:*:*:*:*:*:*:*",
"cpe:2.3:o:gl-inet:gl-ar750_firmware:-:*:*:*:*:*:*:*",
"cpe:2.3:o:gl-inet:gl-ar300m_firmware:-:*:*:*:*:*:*:*",
"cpe:2.3:o:gl-inet:gl-ar750s_firmware:-:*:*:*:*:*:*:*",
"cpe:2.3:o:gl-inet:gl-b1300_firmware:-:*:*:*:*:*:*:*",
"cpe:2.3:o:gl-inet:gl-e750_firmware:-:*:*:*:*:*:*:*",
"cpe:2.3:o:gl-inet:gl-mt300n-v2_firmware:-:*:*:*:*:*:*:*",
"cpe:2.3:o:gl-inet:gl-xe300_firmware:-:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "gl-xe300_firmware",
"vendor": "gl-inet",
"versions": [
{
"lessThan": "4.3.18",
"status": "affected",
"version": "4.3.17",
"versionType": "custom"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "ADJACENT_NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2024-45259",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-10-28T19:31:51.013958Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-326",
"description": "CWE-326 Inadequate Encryption Strength",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-10-28T19:38:53.728Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "An issue was discovered on certain GL-iNet devices, including MT6000, MT3000, MT2500, AXT1800, and AX1800 4.6.2. By intercepting an HTTP request and changing the filename property in the download interface, any file on the device can be deleted."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-10-24T20:09:41.653Z",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"url": "https://github.com/gl-inet/CVE-issues/blob/main/4.0.0/Delete%20Any%20File%20via%20Download%20Interface.md"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2024-45259",
"datePublished": "2024-10-24T00:00:00.000Z",
"dateReserved": "2024-08-25T00:00:00.000Z",
"dateUpdated": "2024-10-28T19:38:53.728Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2023-31475 (GCVE-0-2023-31475)
Vulnerability from cvelistv5 – Published: 2023-05-11 00:00 – Updated: 2025-01-27 17:17
VLAI
EPSS
VEX
Summary
An issue was discovered on GL.iNet devices before 3.216. The function guci2_get() found in libglutil.so has a buffer overflow when an item is requested from a UCI context, and the value is pasted into a char pointer to a buffer without checking the size of the buffer.
Severity
9 (Critical)
SSVC
Exploitation: poc
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2025-01-27 17:16 UTC
CWE
- n/a
- CWE-120 - Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')
Assigner
References
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-02T14:53:30.627Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_transferred"
],
"url": "https://www.gl-inet.com"
},
{
"tags": [
"x_transferred"
],
"url": "https://github.com/gl-inet/CVE-issues/blob/main/3.215/Buffer_Overflow.md"
},
{
"tags": [
"x_transferred"
],
"url": "https://justinapplegate.me/2023/glinet-CVE-2023-31475/"
}
],
"title": "CVE Program Container"
},
{
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2023-31475",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-01-27T17:16:58.373267Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-120",
"description": "CWE-120 Buffer Copy without Checking Size of Input (\u0027Classic Buffer Overflow\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-01-27T17:17:11.696Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "An issue was discovered on GL.iNet devices before 3.216. The function guci2_get() found in libglutil.so has a buffer overflow when an item is requested from a UCI context, and the value is pasted into a char pointer to a buffer without checking the size of the buffer."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2023-06-12T00:00:00.000Z",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"url": "https://www.gl-inet.com"
},
{
"url": "https://github.com/gl-inet/CVE-issues/blob/main/3.215/Buffer_Overflow.md"
},
{
"url": "https://justinapplegate.me/2023/glinet-CVE-2023-31475/"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2023-31475",
"datePublished": "2023-05-11T00:00:00.000Z",
"dateReserved": "2023-04-28T00:00:00.000Z",
"dateUpdated": "2025-01-27T17:17:11.696Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2023-31477 (GCVE-0-2023-31477)
Vulnerability from cvelistv5 – Published: 2023-05-11 00:00 – Updated: 2025-01-27 17:15
VLAI
EPSS
VEX
Summary
A path traversal issue was discovered on GL.iNet devices before 3.216. Through the file sharing feature, it is possible to share an arbitrary directory, such as /tmp or /etc, because there is no server-side restriction to limit sharing to the USB path.
Severity
7.5 (High)
SSVC
Exploitation: poc
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2025-01-27 17:15 UTC
CWE
- n/a
- CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Assigner
References
2 references
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-02T14:53:31.074Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_transferred"
],
"url": "https://www.gl-inet.com"
},
{
"tags": [
"x_transferred"
],
"url": "https://github.com/gl-inet/CVE-issues/blob/main/3.215/Path_Traversal.md"
}
],
"title": "CVE Program Container"
},
{
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2023-31477",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-01-27T17:15:20.706586Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-22",
"description": "CWE-22 Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-01-27T17:15:44.508Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "A path traversal issue was discovered on GL.iNet devices before 3.216. Through the file sharing feature, it is possible to share an arbitrary directory, such as /tmp or /etc, because there is no server-side restriction to limit sharing to the USB path."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2023-05-11T00:00:00.000Z",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"url": "https://www.gl-inet.com"
},
{
"url": "https://github.com/gl-inet/CVE-issues/blob/main/3.215/Path_Traversal.md"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2023-31477",
"datePublished": "2023-05-11T00:00:00.000Z",
"dateReserved": "2023-04-28T00:00:00.000Z",
"dateUpdated": "2025-01-27T17:15:44.508Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2023-31473 (GCVE-0-2023-31473)
Vulnerability from cvelistv5 – Published: 2023-05-11 00:00 – Updated: 2025-01-27 17:18
VLAI
EPSS
VEX
Summary
An issue was discovered on GL.iNet devices before 3.216. There is an arbitrary file write in which an empty file can be created anywhere on the filesystem. This is caused by a command injection vulnerability with a filter applied. Through the software installation feature, it is possible to inject arbitrary parameters in a request to cause opkg to read an arbitrary file name while using root privileges. The -f option can be used with a configuration file.
Severity
4.9 (Medium)
SSVC
Exploitation: poc
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2025-01-27 17:18 UTC
CWE
- n/a
- CWE-77 - Improper Neutralization of Special Elements used in a Command ('Command Injection')
Assigner
References
2 references
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-02T14:53:30.985Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_transferred"
],
"url": "https://www.gl-inet.com"
},
{
"tags": [
"x_transferred"
],
"url": "https://github.com/gl-inet/CVE-issues/blob/main/3.215/Arbitrary_File_Read.md"
}
],
"title": "CVE Program Container"
},
{
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 4.9,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "HIGH",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2023-31473",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-01-27T17:18:19.394710Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-77",
"description": "CWE-77 Improper Neutralization of Special Elements used in a Command (\u0027Command Injection\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-01-27T17:18:23.785Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "An issue was discovered on GL.iNet devices before 3.216. There is an arbitrary file write in which an empty file can be created anywhere on the filesystem. This is caused by a command injection vulnerability with a filter applied. Through the software installation feature, it is possible to inject arbitrary parameters in a request to cause opkg to read an arbitrary file name while using root privileges. The -f option can be used with a configuration file."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2023-05-11T00:00:00.000Z",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"url": "https://www.gl-inet.com"
},
{
"url": "https://github.com/gl-inet/CVE-issues/blob/main/3.215/Arbitrary_File_Read.md"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2023-31473",
"datePublished": "2023-05-11T00:00:00.000Z",
"dateReserved": "2023-04-28T00:00:00.000Z",
"dateUpdated": "2025-01-27T17:18:23.785Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2023-31471 (GCVE-0-2023-31471)
Vulnerability from cvelistv5 – Published: 2023-05-10 00:00 – Updated: 2025-01-27 19:26
VLAI
EPSS
VEX
Summary
An issue was discovered on GL.iNet devices before 3.216. Through the software installation feature, it is possible to install arbitrary software, such as a reverse shell, because the restrictions on the available package list are limited to client-side verification. It is possible to install software from the filesystem, the package list, or a URL.
Severity
9.8 (Critical)
SSVC
Exploitation: poc
Automatable: yes
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2025-01-27 19:26 UTC
Assigner
References
2 references
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-02T14:53:31.075Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_transferred"
],
"url": "https://www.gl-inet.com"
},
{
"tags": [
"x_transferred"
],
"url": "https://github.com/gl-inet/CVE-issues/blob/main/3.215/Abuse_of_Functionality_leads_to_RCE.md"
}
],
"title": "CVE Program Container"
},
{
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2023-31471",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-01-27T19:26:35.960125Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "CWE-noinfo Not enough information",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-01-27T19:26:40.342Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "An issue was discovered on GL.iNet devices before 3.216. Through the software installation feature, it is possible to install arbitrary software, such as a reverse shell, because the restrictions on the available package list are limited to client-side verification. It is possible to install software from the filesystem, the package list, or a URL."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2023-05-10T00:00:00.000Z",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"url": "https://www.gl-inet.com"
},
{
"url": "https://github.com/gl-inet/CVE-issues/blob/main/3.215/Abuse_of_Functionality_leads_to_RCE.md"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2023-31471",
"datePublished": "2023-05-10T00:00:00.000Z",
"dateReserved": "2023-04-28T00:00:00.000Z",
"dateUpdated": "2025-01-27T19:26:40.342Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2023-31478 (GCVE-0-2023-31478)
Vulnerability from cvelistv5 – Published: 2023-05-09 00:00 – Updated: 2025-01-29 20:16Summary
An issue was discovered on GL.iNet devices before 3.216. An API endpoint reveals information about the Wi-Fi configuration, including the SSID and key.
Severity
7.5 (High)
SSVC
Exploitation: poc
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2025-01-29 20:15 UTC
Assigner
References
2 references
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-02T14:53:31.026Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_transferred"
],
"url": "https://www.gl-inet.com"
},
{
"tags": [
"x_transferred"
],
"url": "https://github.com/gl-inet/CVE-issues/blob/main/3.215/SSID_Key_Disclosure.md"
}
],
"title": "CVE Program Container"
},
{
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2023-31478",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-01-29T20:15:16.901464Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "CWE-noinfo Not enough information",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-01-29T20:16:30.695Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "An issue was discovered on GL.iNet devices before 3.216. An API endpoint reveals information about the Wi-Fi configuration, including the SSID and key."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2023-05-09T00:00:00.000Z",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"url": "https://www.gl-inet.com"
},
{
"url": "https://github.com/gl-inet/CVE-issues/blob/main/3.215/SSID_Key_Disclosure.md"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2023-31478",
"datePublished": "2023-05-09T00:00:00.000Z",
"dateReserved": "2023-04-28T00:00:00.000Z",
"dateUpdated": "2025-01-29T20:16:30.695Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2023-31472 (GCVE-0-2023-31472)
Vulnerability from cvelistv5 – Published: 2023-05-09 00:00 – Updated: 2025-01-29 20:28
VLAI
EPSS
VEX
Summary
An issue was discovered on GL.iNet devices before 3.216. There is an arbitrary file write in which an empty file can be created anywhere on the filesystem. This is caused by a command injection vulnerability with a filter applied.
Severity
7.5 (High)
SSVC
Exploitation: poc
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2025-01-29 20:27 UTC
CWE
- n/a
- CWE-770 - Allocation of Resources Without Limits or Throttling
Assigner
References
2 references
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-02T14:53:31.081Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_transferred"
],
"url": "https://www.gl-inet.com"
},
{
"tags": [
"x_transferred"
],
"url": "https://github.com/gl-inet/CVE-issues/blob/main/3.215/Arbitrary_File_Creation.md"
}
],
"title": "CVE Program Container"
},
{
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2023-31472",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-01-29T20:27:18.006885Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-770",
"description": "CWE-770 Allocation of Resources Without Limits or Throttling",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-01-29T20:28:12.263Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "An issue was discovered on GL.iNet devices before 3.216. There is an arbitrary file write in which an empty file can be created anywhere on the filesystem. This is caused by a command injection vulnerability with a filter applied."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2023-05-09T00:00:00.000Z",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"url": "https://www.gl-inet.com"
},
{
"url": "https://github.com/gl-inet/CVE-issues/blob/main/3.215/Arbitrary_File_Creation.md"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2023-31472",
"datePublished": "2023-05-09T00:00:00.000Z",
"dateReserved": "2023-04-28T00:00:00.000Z",
"dateUpdated": "2025-01-29T20:28:12.263Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2023-31474 (GCVE-0-2023-31474)
Vulnerability from cvelistv5 – Published: 2023-05-09 00:00 – Updated: 2025-01-29 20:26
VLAI
EPSS
VEX
Summary
An issue was discovered on GL.iNet devices before 3.216. Through the software installation feature, it is possible to inject arbitrary parameters in a request to cause opkg to obtain a list of files in a specific directory, by using the regex feature in a package name.
Severity
7.5 (High)
SSVC
Exploitation: poc
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2025-01-29 20:25 UTC
Assigner
References
2 references
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-02T14:53:30.764Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_transferred"
],
"url": "https://www.gl-inet.com"
},
{
"tags": [
"x_transferred"
],
"url": "https://github.com/gl-inet/CVE-issues/blob/main/3.215/Directory_Listing.md"
}
],
"title": "CVE Program Container"
},
{
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2023-31474",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-01-29T20:25:31.361438Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "CWE-noinfo Not enough information",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-01-29T20:26:33.019Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "An issue was discovered on GL.iNet devices before 3.216. Through the software installation feature, it is possible to inject arbitrary parameters in a request to cause opkg to obtain a list of files in a specific directory, by using the regex feature in a package name."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2023-05-09T00:00:00.000Z",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"url": "https://www.gl-inet.com"
},
{
"url": "https://github.com/gl-inet/CVE-issues/blob/main/3.215/Directory_Listing.md"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2023-31474",
"datePublished": "2023-05-09T00:00:00.000Z",
"dateReserved": "2023-04-28T00:00:00.000Z",
"dateUpdated": "2025-01-29T20:26:33.019Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}