Vulnerability-Lookup

CVE-2025-2811 (GCVE-0-2025-2811)

Vulnerability from cvelistv5 – Published: 2025-04-26 07:00 – Updated: 2025-04-28 18:09

Title

GL.iNet GL-A1300 Slate Plus API redos

Summary

A vulnerability was found in GL.iNet GL-A1300 Slate Plus, GL-AR300M16 Shadow, GL-AR300M Shadow, GL-AR750 Creta, GL-AR750S-EXT Slate, GL-AX1800 Flint, GL-AXT1800 Slate AX, GL-B1300 Convexa-B, GL-B3000 Marble, GL-BE3600 Slate 7, GL-E750, GL-E750V2 Mudi, GL-MT300N-V2 Mango, GL-MT1300 Beryl, GL-MT2500 Brume 2, GL-MT3000 Beryl AX, GL-MT6000 Flint 2, GL-SFT1200 Opal, GL-X300B Collie, GL-X750 Spitz, GL-X3000 Spitz AX, GL-XE300 Puli and GL-XE3000 Puli AX 4.x. It has been declared as problematic. This vulnerability affects unknown code of the component API. The manipulation leads to inefficient regular expression complexity. It is recommended to upgrade the affected component.

Severity

6.9 (Medium)


                        
                          CVSS:4.0/AV:A/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

5.7 (Medium)


                        
                          CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

5.7 (Medium)


                        
                          CVSS:3.0/AV:A/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

SSVC

Exploitation: poc Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2025-04-28 18:07 UTC

CWE

CWE-1333 - Inefficient Regular Expression Complexity
CWE-400 - Resource Consumption

Assigner

VulDB CNA under the mitre root

CNA scorecard B 83/100 over 3844 records in the last 180 days details

References

5 references

URL	Tags
https://vuldb.com/?id.306286	vdb-entry
https://vuldb.com/?ctiid.306286	signaturepermissions-required
https://vuldb.com/?submit.524459	third-party-advisory
https://github.com/gl-inet/CVE-issues/blob/main/4…	related
https://www.gl-inet.com/security-updates/security…	patch

Impacted products

23 products

Vendor	Product	Version	CPE status
GL.iNet	GL-A1300 Slate Plus	Affected: 4.x	guessed
GL.iNet	GL-AR300M16 Shadow	Affected: 4.x	guessed
GL.iNet	GL-AR300M Shadow	Affected: 4.x	guessed
GL.iNet	GL-AR750 Creta	Affected: 4.x	guessed
GL.iNet	GL-AR750S-EXT Slate	Affected: 4.x	guessed
GL.iNet	GL-AX1800 Flint	Affected: 4.x	guessed
GL.iNet	GL-AXT1800 Slate AX	Affected: 4.x	guessed
GL.iNet	GL-B1300 Convexa-B	Affected: 4.x	guessed
GL.iNet	GL-B3000 Marble	Affected: 4.x	guessed
GL.iNet	GL-BE3600 Slate 7	Affected: 4.x	guessed
GL.iNet	GL-E750	Affected: 4.x	guessed
GL.iNet	GL-E750V2 Mudi	Affected: 4.x	guessed
GL.iNet	GL-MT300N-V2 Mango	Affected: 4.x	guessed
GL.iNet	GL-MT1300 Beryl	Affected: 4.x	guessed
GL.iNet	GL-MT2500 Brume 2	Affected: 4.x	guessed
GL.iNet	GL-MT3000 Beryl AX	Affected: 4.x	guessed
GL.iNet	GL-MT6000 Flint 2	Affected: 4.x	guessed
GL.iNet	GL-SFT1200 Opal	Affected: 4.x	guessed
GL.iNet	GL-X300B Collie	Affected: 4.x	guessed
GL.iNet	GL-X750 Spitz	Affected: 4.x	guessed
GL.iNet	GL-X3000 Spitz AX	Affected: 4.x	guessed
GL.iNet	GL-XE300 Puli	Affected: 4.x	guessed
GL.iNet	GL-XE3000 Puli AX	Affected: 4.x	guessed

Credits

pan.li (VulDB User)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2025-2811",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-04-28T18:07:38.354152Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-04-28T18:09:59.404Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "exploit"
            ],
            "url": "https://github.com/gl-inet/CVE-issues/blob/main/4.0.0/Calling%20a%20special%20API%20that%20doesn\u0027t%20require%20login%20and%20passing%20in%20a%20special%20character%20parameter%20results%20in%20100%25%20CPU%20usage.md"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "modules": [
            "API"
          ],
          "product": "GL-A1300 Slate Plus",
          "vendor": "GL.iNet",
          "versions": [
            {
              "status": "affected",
              "version": "4.x"
            }
          ]
        },
        {
          "modules": [
            "API"
          ],
          "product": "GL-AR300M16 Shadow",
          "vendor": "GL.iNet",
          "versions": [
            {
              "status": "affected",
              "version": "4.x"
            }
          ]
        },
        {
          "modules": [
            "API"
          ],
          "product": "GL-AR300M Shadow",
          "vendor": "GL.iNet",
          "versions": [
            {
              "status": "affected",
              "version": "4.x"
            }
          ]
        },
        {
          "modules": [
            "API"
          ],
          "product": "GL-AR750 Creta",
          "vendor": "GL.iNet",
          "versions": [
            {
              "status": "affected",
              "version": "4.x"
            }
          ]
        },
        {
          "modules": [
            "API"
          ],
          "product": "GL-AR750S-EXT Slate",
          "vendor": "GL.iNet",
          "versions": [
            {
              "status": "affected",
              "version": "4.x"
            }
          ]
        },
        {
          "modules": [
            "API"
          ],
          "product": "GL-AX1800 Flint",
          "vendor": "GL.iNet",
          "versions": [
            {
              "status": "affected",
              "version": "4.x"
            }
          ]
        },
        {
          "modules": [
            "API"
          ],
          "product": "GL-AXT1800 Slate AX",
          "vendor": "GL.iNet",
          "versions": [
            {
              "status": "affected",
              "version": "4.x"
            }
          ]
        },
        {
          "modules": [
            "API"
          ],
          "product": "GL-B1300 Convexa-B",
          "vendor": "GL.iNet",
          "versions": [
            {
              "status": "affected",
              "version": "4.x"
            }
          ]
        },
        {
          "modules": [
            "API"
          ],
          "product": "GL-B3000 Marble",
          "vendor": "GL.iNet",
          "versions": [
            {
              "status": "affected",
              "version": "4.x"
            }
          ]
        },
        {
          "modules": [
            "API"
          ],
          "product": "GL-BE3600 Slate 7",
          "vendor": "GL.iNet",
          "versions": [
            {
              "status": "affected",
              "version": "4.x"
            }
          ]
        },
        {
          "modules": [
            "API"
          ],
          "product": "GL-E750",
          "vendor": "GL.iNet",
          "versions": [
            {
              "status": "affected",
              "version": "4.x"
            }
          ]
        },
        {
          "modules": [
            "API"
          ],
          "product": "GL-E750V2 Mudi",
          "vendor": "GL.iNet",
          "versions": [
            {
              "status": "affected",
              "version": "4.x"
            }
          ]
        },
        {
          "modules": [
            "API"
          ],
          "product": "GL-MT300N-V2 Mango",
          "vendor": "GL.iNet",
          "versions": [
            {
              "status": "affected",
              "version": "4.x"
            }
          ]
        },
        {
          "modules": [
            "API"
          ],
          "product": "GL-MT1300 Beryl",
          "vendor": "GL.iNet",
          "versions": [
            {
              "status": "affected",
              "version": "4.x"
            }
          ]
        },
        {
          "modules": [
            "API"
          ],
          "product": "GL-MT2500 Brume 2",
          "vendor": "GL.iNet",
          "versions": [
            {
              "status": "affected",
              "version": "4.x"
            }
          ]
        },
        {
          "modules": [
            "API"
          ],
          "product": "GL-MT3000 Beryl AX",
          "vendor": "GL.iNet",
          "versions": [
            {
              "status": "affected",
              "version": "4.x"
            }
          ]
        },
        {
          "modules": [
            "API"
          ],
          "product": "GL-MT6000 Flint 2",
          "vendor": "GL.iNet",
          "versions": [
            {
              "status": "affected",
              "version": "4.x"
            }
          ]
        },
        {
          "modules": [
            "API"
          ],
          "product": "GL-SFT1200 Opal",
          "vendor": "GL.iNet",
          "versions": [
            {
              "status": "affected",
              "version": "4.x"
            }
          ]
        },
        {
          "modules": [
            "API"
          ],
          "product": "GL-X300B Collie",
          "vendor": "GL.iNet",
          "versions": [
            {
              "status": "affected",
              "version": "4.x"
            }
          ]
        },
        {
          "modules": [
            "API"
          ],
          "product": "GL-X750 Spitz",
          "vendor": "GL.iNet",
          "versions": [
            {
              "status": "affected",
              "version": "4.x"
            }
          ]
        },
        {
          "modules": [
            "API"
          ],
          "product": "GL-X3000 Spitz AX",
          "vendor": "GL.iNet",
          "versions": [
            {
              "status": "affected",
              "version": "4.x"
            }
          ]
        },
        {
          "modules": [
            "API"
          ],
          "product": "GL-XE300 Puli",
          "vendor": "GL.iNet",
          "versions": [
            {
              "status": "affected",
              "version": "4.x"
            }
          ]
        },
        {
          "modules": [
            "API"
          ],
          "product": "GL-XE3000 Puli AX",
          "vendor": "GL.iNet",
          "versions": [
            {
              "status": "affected",
              "version": "4.x"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "reporter",
          "value": "pan.li (VulDB User)"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "A vulnerability was found in GL.iNet GL-A1300 Slate Plus, GL-AR300M16 Shadow, GL-AR300M Shadow, GL-AR750 Creta, GL-AR750S-EXT Slate, GL-AX1800 Flint, GL-AXT1800 Slate AX, GL-B1300 Convexa-B, GL-B3000 Marble, GL-BE3600 Slate 7, GL-E750, GL-E750V2 Mudi, GL-MT300N-V2 Mango, GL-MT1300 Beryl, GL-MT2500 Brume 2, GL-MT3000 Beryl AX, GL-MT6000 Flint 2, GL-SFT1200 Opal, GL-X300B Collie, GL-X750 Spitz, GL-X3000 Spitz AX, GL-XE300 Puli and GL-XE3000 Puli AX 4.x. It has been declared as problematic. This vulnerability affects unknown code of the component API. The manipulation leads to inefficient regular expression complexity. It is recommended to upgrade the affected component."
        },
        {
          "lang": "de",
          "value": "In GL.iNet GL-A1300 Slate Plus, GL-AR300M16 Shadow, GL-AR300M Shadow, GL-AR750 Creta, GL-AR750S-EXT Slate, GL-AX1800 Flint, GL-AXT1800 Slate AX, GL-B1300 Convexa-B, GL-B3000 Marble, GL-BE3600 Slate 7, GL-E750, GL-E750V2 Mudi, GL-MT300N-V2 Mango, GL-MT1300 Beryl, GL-MT2500 Brume 2, GL-MT3000 Beryl AX, GL-MT6000 Flint 2, GL-SFT1200 Opal, GL-X300B Collie, GL-X750 Spitz, GL-X3000 Spitz AX, GL-XE300 Puli and GL-XE3000 Puli AX 4.x wurde eine Schwachstelle ausgemacht. Sie wurde als problematisch eingestuft. Das betrifft eine unbekannte Funktionalit\u00e4t der Komponente API. Mit der Manipulation mit unbekannten Daten kann eine inefficient regular expression complexity-Schwachstelle ausgenutzt werden. Als bestm\u00f6gliche Massnahme wird das Einspielen eines Upgrades empfohlen."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "baseScore": 6.9,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:4.0/AV:A/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
            "version": "4.0"
          }
        },
        {
          "cvssV3_1": {
            "baseScore": 5.7,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          }
        },
        {
          "cvssV3_0": {
            "baseScore": 5.7,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.0/AV:A/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.0"
          }
        },
        {
          "cvssV2_0": {
            "baseScore": 5.5,
            "vectorString": "AV:A/AC:L/Au:S/C:N/I:N/A:C",
            "version": "2.0"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-1333",
              "description": "Inefficient Regular Expression Complexity",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-400",
              "description": "Resource Consumption",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-04-26T07:00:05.770Z",
        "orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
        "shortName": "VulDB"
      },
      "references": [
        {
          "name": "VDB-306286 | GL.iNet GL-A1300 Slate Plus API redos",
          "tags": [
            "vdb-entry"
          ],
          "url": "https://vuldb.com/?id.306286"
        },
        {
          "name": "VDB-306286 | CTI Indicators (IOB, IOC, TTP)",
          "tags": [
            "signature",
            "permissions-required"
          ],
          "url": "https://vuldb.com/?ctiid.306286"
        },
        {
          "name": "Submit #524459 | glinet MT6000 /MT3000 /MT2500 /AXT1800 /AX1800 /B3000 /A1300 /X300B /X3000 /XE3000 /X750 /SFT1200 /MT1300 /E750 /XE300 /AR750 /AR750S / v4.x Large or infinite loop",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://vuldb.com/?submit.524459"
        },
        {
          "tags": [
            "related"
          ],
          "url": "https://github.com/gl-inet/CVE-issues/blob/main/4.0.0/Calling%20a%20special%20API%20that%20doesn\u0027t%20require%20login%20and%20passing%20in%20a%20special%20character%20parameter%20results%20in%20100%25%20CPU%20usage.md"
        },
        {
          "tags": [
            "patch"
          ],
          "url": "https://www.gl-inet.com/security-updates/security-advisories-vulnerabilities-and-cves-apr-24-2025/"
        }
      ],
      "timeline": [
        {
          "lang": "en",
          "time": "2025-04-26T00:00:00.000Z",
          "value": "Advisory disclosed"
        },
        {
          "lang": "en",
          "time": "2025-04-26T02:00:00.000Z",
          "value": "VulDB entry created"
        },
        {
          "lang": "en",
          "time": "2025-04-26T08:38:01.000Z",
          "value": "VulDB entry last update"
        }
      ],
      "title": "GL.iNet GL-A1300 Slate Plus API redos"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
    "assignerShortName": "VulDB",
    "cveId": "CVE-2025-2811",
    "datePublished": "2025-04-26T07:00:05.770Z",
    "dateReserved": "2025-03-26T12:11:36.452Z",
    "dateUpdated": "2025-04-28T18:09:59.404Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2025-2811",
      "date": "2026-11-09",
      "epss": "0.00361",
      "percentile": "0.3014"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "modules": [
                  "API"
                ],
                "product": "GL-A1300 Slate Plus",
                "vendor": "GL.iNet",
                "versions": [
                  {
                    "status": "affected",
                    "version": "4.x"
                  }
                ]
              },
              {
                "modules": [
                  "API"
                ],
                "product": "GL-AR300M16 Shadow",
                "vendor": "GL.iNet",
                "versions": [
                  {
                    "status": "affected",
                    "version": "4.x"
                  }
                ]
              },
              {
                "modules": [
                  "API"
                ],
                "product": "GL-AR300M Shadow",
                "vendor": "GL.iNet",
                "versions": [
                  {
                    "status": "affected",
                    "version": "4.x"
                  }
                ]
              },
              {
                "modules": [
                  "API"
                ],
                "product": "GL-AR750 Creta",
                "vendor": "GL.iNet",
                "versions": [
                  {
                    "status": "affected",
                    "version": "4.x"
                  }
                ]
              },
              {
                "modules": [
                  "API"
                ],
                "product": "GL-AR750S-EXT Slate",
                "vendor": "GL.iNet",
                "versions": [
                  {
                    "status": "affected",
                    "version": "4.x"
                  }
                ]
              },
              {
                "modules": [
                  "API"
                ],
                "product": "GL-AX1800 Flint",
                "vendor": "GL.iNet",
                "versions": [
                  {
                    "status": "affected",
                    "version": "4.x"
                  }
                ]
              },
              {
                "modules": [
                  "API"
                ],
                "product": "GL-AXT1800 Slate AX",
                "vendor": "GL.iNet",
                "versions": [
                  {
                    "status": "affected",
                    "version": "4.x"
                  }
                ]
              },
              {
                "modules": [
                  "API"
                ],
                "product": "GL-B1300 Convexa-B",
                "vendor": "GL.iNet",
                "versions": [
                  {
                    "status": "affected",
                    "version": "4.x"
                  }
                ]
              },
              {
                "modules": [
                  "API"
                ],
                "product": "GL-B3000 Marble",
                "vendor": "GL.iNet",
                "versions": [
                  {
                    "status": "affected",
                    "version": "4.x"
                  }
                ]
              },
              {
                "modules": [
                  "API"
                ],
                "product": "GL-BE3600 Slate 7",
                "vendor": "GL.iNet",
                "versions": [
                  {
                    "status": "affected",
                    "version": "4.x"
                  }
                ]
              },
              {
                "modules": [
                  "API"
                ],
                "product": "GL-E750",
                "vendor": "GL.iNet",
                "versions": [
                  {
                    "status": "affected",
                    "version": "4.x"
                  }
                ]
              },
              {
                "modules": [
                  "API"
                ],
                "product": "GL-E750V2 Mudi",
                "vendor": "GL.iNet",
                "versions": [
                  {
                    "status": "affected",
                    "version": "4.x"
                  }
                ]
              },
              {
                "modules": [
                  "API"
                ],
                "product": "GL-MT300N-V2 Mango",
                "vendor": "GL.iNet",
                "versions": [
                  {
                    "status": "affected",
                    "version": "4.x"
                  }
                ]
              },
              {
                "modules": [
                  "API"
                ],
                "product": "GL-MT1300 Beryl",
                "vendor": "GL.iNet",
                "versions": [
                  {
                    "status": "affected",
                    "version": "4.x"
                  }
                ]
              },
              {
                "modules": [
                  "API"
                ],
                "product": "GL-MT2500 Brume 2",
                "vendor": "GL.iNet",
                "versions": [
                  {
                    "status": "affected",
                    "version": "4.x"
                  }
                ]
              },
              {
                "modules": [
                  "API"
                ],
                "product": "GL-MT3000 Beryl AX",
                "vendor": "GL.iNet",
                "versions": [
                  {
                    "status": "affected",
                    "version": "4.x"
                  }
                ]
              },
              {
                "modules": [
                  "API"
                ],
                "product": "GL-MT6000 Flint 2",
                "vendor": "GL.iNet",
                "versions": [
                  {
                    "status": "affected",
                    "version": "4.x"
                  }
                ]
              },
              {
                "modules": [
                  "API"
                ],
                "product": "GL-SFT1200 Opal",
                "vendor": "GL.iNet",
                "versions": [
                  {
                    "status": "affected",
                    "version": "4.x"
                  }
                ]
              },
              {
                "modules": [
                  "API"
                ],
                "product": "GL-X300B Collie",
                "vendor": "GL.iNet",
                "versions": [
                  {
                    "status": "affected",
                    "version": "4.x"
                  }
                ]
              },
              {
                "modules": [
                  "API"
                ],
                "product": "GL-X750 Spitz",
                "vendor": "GL.iNet",
                "versions": [
                  {
                    "status": "affected",
                    "version": "4.x"
                  }
                ]
              },
              {
                "modules": [
                  "API"
                ],
                "product": "GL-X3000 Spitz AX",
                "vendor": "GL.iNet",
                "versions": [
                  {
                    "status": "affected",
                    "version": "4.x"
                  }
                ]
              },
              {
                "modules": [
                  "API"
                ],
                "product": "GL-XE300 Puli",
                "vendor": "GL.iNet",
                "versions": [
                  {
                    "status": "affected",
                    "version": "4.x"
                  }
                ]
              },
              {
                "modules": [
                  "API"
                ],
                "product": "GL-XE3000 Puli AX",
                "vendor": "GL.iNet",
                "versions": [
                  {
                    "status": "affected",
                    "version": "4.x"
                  }
                ]
              }
            ],
            "source": "cna@vuldb.com"
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "A vulnerability was found in GL.iNet GL-A1300 Slate Plus, GL-AR300M16 Shadow, GL-AR300M Shadow, GL-AR750 Creta, GL-AR750S-EXT Slate, GL-AX1800 Flint, GL-AXT1800 Slate AX, GL-B1300 Convexa-B, GL-B3000 Marble, GL-BE3600 Slate 7, GL-E750, GL-E750V2 Mudi, GL-MT300N-V2 Mango, GL-MT1300 Beryl, GL-MT2500 Brume 2, GL-MT3000 Beryl AX, GL-MT6000 Flint 2, GL-SFT1200 Opal, GL-X300B Collie, GL-X750 Spitz, GL-X3000 Spitz AX, GL-XE300 Puli and GL-XE3000 Puli AX 4.x. It has been declared as problematic. This vulnerability affects unknown code of the component API. The manipulation leads to inefficient regular expression complexity. It is recommended to upgrade the affected component."
          },
          {
            "lang": "es",
            "value": "Se encontr\u00f3 una vulnerabilidad en GL.iNet GL-A1300 Slate Plus, GL-AR300M16 Shadow, GL-AR300M Shadow, GL-AR750 Creta, GL-AR750S-EXT Slate, GL-AX1800 Flint, GL-AXT1800 Slate AX, GL-B1300 Convexa-B, GL-B3000 Marble, GL-BE3600 Slate 7, GL-E750, GL-E750V2 Mudi, GL-MT300N-V2 Mango, GL-MT1300 Beryl, GL-MT2500 Brume 2, GL-MT3000 Beryl AX, GL-MT6000 Flint 2, GL-SFT1200 Opal, GL-X300B Collie, GL-X750 Spitz, GL-X3000 Spitz AX. GL-XE300 Puli y GL-XE3000 Puli AX 4.x. Se ha declarado como problem\u00e1tica. Esta vulnerabilidad afecta a c\u00f3digo desconocido de la API del componente. La manipulaci\u00f3n genera una complejidad ineficiente en las expresiones regulares. Se recomienda actualizar el componente afectado."
          }
        ],
        "id": "CVE-2025-2811",
        "lastModified": "2026-06-17T09:07:39.567",
        "metrics": {
          "cvssMetricV2": [
            {
              "acInsufInfo": false,
              "baseSeverity": "MEDIUM",
              "cvssData": {
                "accessComplexity": "LOW",
                "accessVector": "ADJACENT_NETWORK",
                "authentication": "SINGLE",
                "availabilityImpact": "COMPLETE",
                "baseScore": 5.5,
                "confidentialityImpact": "NONE",
                "integrityImpact": "NONE",
                "vectorString": "AV:A/AC:L/Au:S/C:N/I:N/A:C",
                "version": "2.0"
              },
              "exploitabilityScore": 5.1,
              "impactScore": 6.9,
              "obtainAllPrivilege": false,
              "obtainOtherPrivilege": false,
              "obtainUserPrivilege": false,
              "source": "cna@vuldb.com",
              "type": "Secondary",
              "userInteractionRequired": false
            }
          ],
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "ADJACENT_NETWORK",
                "availabilityImpact": "HIGH",
                "baseScore": 5.7,
                "baseSeverity": "MEDIUM",
                "confidentialityImpact": "NONE",
                "integrityImpact": "NONE",
                "privilegesRequired": "LOW",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 2.1,
              "impactScore": 3.6,
              "source": "cna@vuldb.com",
              "type": "Secondary"
            }
          ],
          "cvssMetricV40": [
            {
              "cvssData": {
                "Automatable": "NOT_DEFINED",
                "Recovery": "NOT_DEFINED",
                "Safety": "NOT_DEFINED",
                "attackComplexity": "LOW",
                "attackRequirements": "NONE",
                "attackVector": "ADJACENT",
                "availabilityRequirement": "NOT_DEFINED",
                "baseScore": 6.9,
                "baseSeverity": "MEDIUM",
                "confidentialityRequirement": "NOT_DEFINED",
                "exploitMaturity": "NOT_DEFINED",
                "integrityRequirement": "NOT_DEFINED",
                "modifiedAttackComplexity": "NOT_DEFINED",
                "modifiedAttackRequirements": "NOT_DEFINED",
                "modifiedAttackVector": "NOT_DEFINED",
                "modifiedPrivilegesRequired": "NOT_DEFINED",
                "modifiedSubAvailabilityImpact": "NOT_DEFINED",
                "modifiedSubConfidentialityImpact": "NOT_DEFINED",
                "modifiedSubIntegrityImpact": "NOT_DEFINED",
                "modifiedUserInteraction": "NOT_DEFINED",
                "modifiedVulnAvailabilityImpact": "NOT_DEFINED",
                "modifiedVulnConfidentialityImpact": "NOT_DEFINED",
                "modifiedVulnIntegrityImpact": "NOT_DEFINED",
                "privilegesRequired": "LOW",
                "providerUrgency": "NOT_DEFINED",
                "subAvailabilityImpact": "NONE",
                "subConfidentialityImpact": "NONE",
                "subIntegrityImpact": "NONE",
                "userInteraction": "NONE",
                "valueDensity": "NOT_DEFINED",
                "vectorString": "CVSS:4.0/AV:A/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
                "version": "4.0",
                "vulnAvailabilityImpact": "HIGH",
                "vulnConfidentialityImpact": "NONE",
                "vulnIntegrityImpact": "NONE",
                "vulnerabilityResponseEffort": "NOT_DEFINED"
              },
              "source": "cna@vuldb.com",
              "type": "Secondary"
            }
          ],
          "ssvcV203": [
            {
              "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "ssvcData": {
                "id": "CVE-2025-2811",
                "options": [
                  {
                    "exploitation": "poc"
                  },
                  {
                    "automatable": "no"
                  },
                  {
                    "technicalImpact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-04-28T18:07:38.354152Z",
                "version": "2.0.3"
              }
            }
          ]
        },
        "published": "2025-04-26T07:15:15.380",
        "references": [
          {
            "source": "cna@vuldb.com",
            "url": "https://github.com/gl-inet/CVE-issues/blob/main/4.0.0/Calling%20a%20special%20API%20that%20doesn\u0027t%20require%20login%20and%20passing%20in%20a%20special%20character%20parameter%20results%20in%20100%25%20CPU%20usage.md"
          },
          {
            "source": "cna@vuldb.com",
            "url": "https://vuldb.com/?ctiid.306286"
          },
          {
            "source": "cna@vuldb.com",
            "url": "https://vuldb.com/?id.306286"
          },
          {
            "source": "cna@vuldb.com",
            "url": "https://vuldb.com/?submit.524459"
          },
          {
            "source": "cna@vuldb.com",
            "url": "https://www.gl-inet.com/security-updates/security-advisories-vulnerabilities-and-cves-apr-24-2025/"
          },
          {
            "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
            "url": "https://github.com/gl-inet/CVE-issues/blob/main/4.0.0/Calling%20a%20special%20API%20that%20doesn\u0027t%20require%20login%20and%20passing%20in%20a%20special%20character%20parameter%20results%20in%20100%25%20CPU%20usage.md"
          }
        ],
        "sourceIdentifier": "cna@vuldb.com",
        "vulnStatus": "Deferred",
        "weaknesses": [
          {
            "description": [
              {
                "lang": "en",
                "value": "CWE-400"
              },
              {
                "lang": "en",
                "value": "CWE-1333"
              }
            ],
            "source": "cna@vuldb.com",
            "type": "Secondary"
          }
        ]
      }
    },
    "redhat_vex": {
      "current_release_date": "2025-05-28T18:09:09+00:00",
      "cve": "CVE-2025-2811",
      "id": "CVE-2025-2811",
      "initial_release_date": "2025-01-01T00:00:00+00:00",
      "product_status:known_not_affected": "1",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "GL.iNet GL-A1300 Slate Plus API redos",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2025/cve-2025-2811.json",
      "version": "3"
    },
    "vulnrichment": {
      "containers": {
        "adp": [
          {
            "metrics": [
              {
                "other": {
                  "content": {
                    "id": "CVE-2025-2811",
                    "options": [
                      {
                        "Exploitation": "poc"
                      },
                      {
                        "Automatable": "no"
                      },
                      {
                        "Technical Impact": "partial"
                      }
                    ],
                    "role": "CISA Coordinator",
                    "timestamp": "2025-04-28T18:07:38.354152Z",
                    "version": "2.0.3"
                  },
                  "type": "ssvc"
                }
              }
            ],
            "providerMetadata": {
              "dateUpdated": "2025-04-28T18:07:48.813Z",
              "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "shortName": "CISA-ADP"
            },
            "references": [
              {
                "tags": [
                  "exploit"
                ],
                "url": "https://github.com/gl-inet/CVE-issues/blob/main/4.0.0/Calling%20a%20special%20API%20that%20doesn\u0027t%20require%20login%20and%20passing%20in%20a%20special%20character%20parameter%20results%20in%20100%25%20CPU%20usage.md"
              }
            ],
            "title": "CISA ADP Vulnrichment"
          }
        ],
        "cna": {
          "affected": [
            {
              "modules": [
                "API"
              ],
              "product": "GL-A1300 Slate Plus",
              "vendor": "GL.iNet",
              "versions": [
                {
                  "status": "affected",
                  "version": "4.x"
                }
              ]
            },
            {
              "modules": [
                "API"
              ],
              "product": "GL-AR300M16 Shadow",
              "vendor": "GL.iNet",
              "versions": [
                {
                  "status": "affected",
                  "version": "4.x"
                }
              ]
            },
            {
              "modules": [
                "API"
              ],
              "product": "GL-AR300M Shadow",
              "vendor": "GL.iNet",
              "versions": [
                {
                  "status": "affected",
                  "version": "4.x"
                }
              ]
            },
            {
              "modules": [
                "API"
              ],
              "product": "GL-AR750 Creta",
              "vendor": "GL.iNet",
              "versions": [
                {
                  "status": "affected",
                  "version": "4.x"
                }
              ]
            },
            {
              "modules": [
                "API"
              ],
              "product": "GL-AR750S-EXT Slate",
              "vendor": "GL.iNet",
              "versions": [
                {
                  "status": "affected",
                  "version": "4.x"
                }
              ]
            },
            {
              "modules": [
                "API"
              ],
              "product": "GL-AX1800 Flint",
              "vendor": "GL.iNet",
              "versions": [
                {
                  "status": "affected",
                  "version": "4.x"
                }
              ]
            },
            {
              "modules": [
                "API"
              ],
              "product": "GL-AXT1800 Slate AX",
              "vendor": "GL.iNet",
              "versions": [
                {
                  "status": "affected",
                  "version": "4.x"
                }
              ]
            },
            {
              "modules": [
                "API"
              ],
              "product": "GL-B1300 Convexa-B",
              "vendor": "GL.iNet",
              "versions": [
                {
                  "status": "affected",
                  "version": "4.x"
                }
              ]
            },
            {
              "modules": [
                "API"
              ],
              "product": "GL-B3000 Marble",
              "vendor": "GL.iNet",
              "versions": [
                {
                  "status": "affected",
                  "version": "4.x"
                }
              ]
            },
            {
              "modules": [
                "API"
              ],
              "product": "GL-BE3600 Slate 7",
              "vendor": "GL.iNet",
              "versions": [
                {
                  "status": "affected",
                  "version": "4.x"
                }
              ]
            },
            {
              "modules": [
                "API"
              ],
              "product": "GL-E750",
              "vendor": "GL.iNet",
              "versions": [
                {
                  "status": "affected",
                  "version": "4.x"
                }
              ]
            },
            {
              "modules": [
                "API"
              ],
              "product": "GL-E750V2 Mudi",
              "vendor": "GL.iNet",
              "versions": [
                {
                  "status": "affected",
                  "version": "4.x"
                }
              ]
            },
            {
              "modules": [
                "API"
              ],
              "product": "GL-MT300N-V2 Mango",
              "vendor": "GL.iNet",
              "versions": [
                {
                  "status": "affected",
                  "version": "4.x"
                }
              ]
            },
            {
              "modules": [
                "API"
              ],
              "product": "GL-MT1300 Beryl",
              "vendor": "GL.iNet",
              "versions": [
                {
                  "status": "affected",
                  "version": "4.x"
                }
              ]
            },
            {
              "modules": [
                "API"
              ],
              "product": "GL-MT2500 Brume 2",
              "vendor": "GL.iNet",
              "versions": [
                {
                  "status": "affected",
                  "version": "4.x"
                }
              ]
            },
            {
              "modules": [
                "API"
              ],
              "product": "GL-MT3000 Beryl AX",
              "vendor": "GL.iNet",
              "versions": [
                {
                  "status": "affected",
                  "version": "4.x"
                }
              ]
            },
            {
              "modules": [
                "API"
              ],
              "product": "GL-MT6000 Flint 2",
              "vendor": "GL.iNet",
              "versions": [
                {
                  "status": "affected",
                  "version": "4.x"
                }
              ]
            },
            {
              "modules": [
                "API"
              ],
              "product": "GL-SFT1200 Opal",
              "vendor": "GL.iNet",
              "versions": [
                {
                  "status": "affected",
                  "version": "4.x"
                }
              ]
            },
            {
              "modules": [
                "API"
              ],
              "product": "GL-X300B Collie",
              "vendor": "GL.iNet",
              "versions": [
                {
                  "status": "affected",
                  "version": "4.x"
                }
              ]
            },
            {
              "modules": [
                "API"
              ],
              "product": "GL-X750 Spitz",
              "vendor": "GL.iNet",
              "versions": [
                {
                  "status": "affected",
                  "version": "4.x"
                }
              ]
            },
            {
              "modules": [
                "API"
              ],
              "product": "GL-X3000 Spitz AX",
              "vendor": "GL.iNet",
              "versions": [
                {
                  "status": "affected",
                  "version": "4.x"
                }
              ]
            },
            {
              "modules": [
                "API"
              ],
              "product": "GL-XE300 Puli",
              "vendor": "GL.iNet",
              "versions": [
                {
                  "status": "affected",
                  "version": "4.x"
                }
              ]
            },
            {
              "modules": [
                "API"
              ],
              "product": "GL-XE3000 Puli AX",
              "vendor": "GL.iNet",
              "versions": [
                {
                  "status": "affected",
                  "version": "4.x"
                }
              ]
            }
          ],
          "credits": [
            {
              "lang": "en",
              "type": "reporter",
              "value": "pan.li (VulDB User)"
            }
          ],
          "descriptions": [
            {
              "lang": "en",
              "value": "A vulnerability was found in GL.iNet GL-A1300 Slate Plus, GL-AR300M16 Shadow, GL-AR300M Shadow, GL-AR750 Creta, GL-AR750S-EXT Slate, GL-AX1800 Flint, GL-AXT1800 Slate AX, GL-B1300 Convexa-B, GL-B3000 Marble, GL-BE3600 Slate 7, GL-E750, GL-E750V2 Mudi, GL-MT300N-V2 Mango, GL-MT1300 Beryl, GL-MT2500 Brume 2, GL-MT3000 Beryl AX, GL-MT6000 Flint 2, GL-SFT1200 Opal, GL-X300B Collie, GL-X750 Spitz, GL-X3000 Spitz AX, GL-XE300 Puli and GL-XE3000 Puli AX 4.x. It has been declared as problematic. This vulnerability affects unknown code of the component API. The manipulation leads to inefficient regular expression complexity. It is recommended to upgrade the affected component."
            },
            {
              "lang": "de",
              "value": "In GL.iNet GL-A1300 Slate Plus, GL-AR300M16 Shadow, GL-AR300M Shadow, GL-AR750 Creta, GL-AR750S-EXT Slate, GL-AX1800 Flint, GL-AXT1800 Slate AX, GL-B1300 Convexa-B, GL-B3000 Marble, GL-BE3600 Slate 7, GL-E750, GL-E750V2 Mudi, GL-MT300N-V2 Mango, GL-MT1300 Beryl, GL-MT2500 Brume 2, GL-MT3000 Beryl AX, GL-MT6000 Flint 2, GL-SFT1200 Opal, GL-X300B Collie, GL-X750 Spitz, GL-X3000 Spitz AX, GL-XE300 Puli and GL-XE3000 Puli AX 4.x wurde eine Schwachstelle ausgemacht. Sie wurde als problematisch eingestuft. Das betrifft eine unbekannte Funktionalit\u00e4t der Komponente API. Mit der Manipulation mit unbekannten Daten kann eine inefficient regular expression complexity-Schwachstelle ausgenutzt werden. Als bestm\u00f6gliche Massnahme wird das Einspielen eines Upgrades empfohlen."
            }
          ],
          "metrics": [
            {
              "cvssV4_0": {
                "baseScore": 6.9,
                "baseSeverity": "MEDIUM",
                "vectorString": "CVSS:4.0/AV:A/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
                "version": "4.0"
              }
            },
            {
              "cvssV3_1": {
                "baseScore": 5.7,
                "baseSeverity": "MEDIUM",
                "vectorString": "CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
                "version": "3.1"
              }
            },
            {
              "cvssV3_0": {
                "baseScore": 5.7,
                "baseSeverity": "MEDIUM",
                "vectorString": "CVSS:3.0/AV:A/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
                "version": "3.0"
              }
            },
            {
              "cvssV2_0": {
                "baseScore": 5.5,
                "vectorString": "AV:A/AC:L/Au:S/C:N/I:N/A:C",
                "version": "2.0"
              }
            }
          ],
          "problemTypes": [
            {
              "descriptions": [
                {
                  "cweId": "CWE-1333",
                  "description": "Inefficient Regular Expression Complexity",
                  "lang": "en",
                  "type": "CWE"
                }
              ]
            },
            {
              "descriptions": [
                {
                  "cweId": "CWE-400",
                  "description": "Resource Consumption",
                  "lang": "en",
                  "type": "CWE"
                }
              ]
            }
          ],
          "providerMetadata": {
            "dateUpdated": "2025-04-26T07:00:05.770Z",
            "orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
            "shortName": "VulDB"
          },
          "references": [
            {
              "name": "VDB-306286 | GL.iNet GL-A1300 Slate Plus API redos",
              "tags": [
                "vdb-entry"
              ],
              "url": "https://vuldb.com/?id.306286"
            },
            {
              "name": "VDB-306286 | CTI Indicators (IOB, IOC, TTP)",
              "tags": [
                "signature",
                "permissions-required"
              ],
              "url": "https://vuldb.com/?ctiid.306286"
            },
            {
              "name": "Submit #524459 | glinet MT6000 /MT3000 /MT2500 /AXT1800 /AX1800 /B3000 /A1300 /X300B /X3000 /XE3000 /X750 /SFT1200 /MT1300 /E750 /XE300 /AR750 /AR750S / v4.x Large or infinite loop",
              "tags": [
                "third-party-advisory"
              ],
              "url": "https://vuldb.com/?submit.524459"
            },
            {
              "tags": [
                "related"
              ],
              "url": "https://github.com/gl-inet/CVE-issues/blob/main/4.0.0/Calling%20a%20special%20API%20that%20doesn\u0027t%20require%20login%20and%20passing%20in%20a%20special%20character%20parameter%20results%20in%20100%25%20CPU%20usage.md"
            },
            {
              "tags": [
                "patch"
              ],
              "url": "https://www.gl-inet.com/security-updates/security-advisories-vulnerabilities-and-cves-apr-24-2025/"
            }
          ],
          "timeline": [
            {
              "lang": "en",
              "time": "2025-04-26T00:00:00.000Z",
              "value": "Advisory disclosed"
            },
            {
              "lang": "en",
              "time": "2025-04-26T02:00:00.000Z",
              "value": "VulDB entry created"
            },
            {
              "lang": "en",
              "time": "2025-04-26T08:38:01.000Z",
              "value": "VulDB entry last update"
            }
          ],
          "title": "GL.iNet GL-A1300 Slate Plus API redos"
        }
      },
      "cveMetadata": {
        "assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
        "assignerShortName": "VulDB",
        "cveId": "CVE-2025-2811",
        "datePublished": "2025-04-26T07:00:05.770Z",
        "dateReserved": "2025-03-26T12:11:36.452Z",
        "dateUpdated": "2025-04-28T18:09:59.404Z",
        "state": "PUBLISHED"
      },
      "dataType": "CVE_RECORD",
      "dataVersion": "5.1"
    }
  }
}

FKIE_CVE-2025-2811

Vulnerability from fkie_nvd - Published: 2025-04-26 07:15 - Updated: 2026-06-17 09:07

Severity

5.7 (Medium) - CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Summary

References

	URL	Tags
	cna@vuldb.com	https://github.com/gl-inet/CVE-issues/blob/main/4.0.0/Calling%20a%20special%20API%20that%20doesn't%20require%20login%20and%20passing%20in%20a%20special%20character%20parameter%20results%20in%20100%25%20CPU%20usage.md
	cna@vuldb.com	https://vuldb.com/?ctiid.306286
	cna@vuldb.com	https://vuldb.com/?id.306286
	cna@vuldb.com	https://vuldb.com/?submit.524459
	cna@vuldb.com	https://www.gl-inet.com/security-updates/security-advisories-vulnerabilities-and-cves-apr-24-2025/
	134c704f-9b21-4f2e-91b3-4a467353bcc0	https://github.com/gl-inet/CVE-issues/blob/main/4.0.0/Calling%20a%20special%20API%20that%20doesn't%20require%20login%20and%20passing%20in%20a%20special%20character%20parameter%20results%20in%20100%25%20CPU%20usage.md

Impacted products

	Vendor	Product	Version

JSON

To clipboard

{
  "affected": [
    {
      "affectedData": [
        {
          "modules": [
            "API"
          ],
          "product": "GL-A1300 Slate Plus",
          "vendor": "GL.iNet",
          "versions": [
            {
              "status": "affected",
              "version": "4.x"
            }
          ]
        },
        {
          "modules": [
            "API"
          ],
          "product": "GL-AR300M16 Shadow",
          "vendor": "GL.iNet",
          "versions": [
            {
              "status": "affected",
              "version": "4.x"
            }
          ]
        },
        {
          "modules": [
            "API"
          ],
          "product": "GL-AR300M Shadow",
          "vendor": "GL.iNet",
          "versions": [
            {
              "status": "affected",
              "version": "4.x"
            }
          ]
        },
        {
          "modules": [
            "API"
          ],
          "product": "GL-AR750 Creta",
          "vendor": "GL.iNet",
          "versions": [
            {
              "status": "affected",
              "version": "4.x"
            }
          ]
        },
        {
          "modules": [
            "API"
          ],
          "product": "GL-AR750S-EXT Slate",
          "vendor": "GL.iNet",
          "versions": [
            {
              "status": "affected",
              "version": "4.x"
            }
          ]
        },
        {
          "modules": [
            "API"
          ],
          "product": "GL-AX1800 Flint",
          "vendor": "GL.iNet",
          "versions": [
            {
              "status": "affected",
              "version": "4.x"
            }
          ]
        },
        {
          "modules": [
            "API"
          ],
          "product": "GL-AXT1800 Slate AX",
          "vendor": "GL.iNet",
          "versions": [
            {
              "status": "affected",
              "version": "4.x"
            }
          ]
        },
        {
          "modules": [
            "API"
          ],
          "product": "GL-B1300 Convexa-B",
          "vendor": "GL.iNet",
          "versions": [
            {
              "status": "affected",
              "version": "4.x"
            }
          ]
        },
        {
          "modules": [
            "API"
          ],
          "product": "GL-B3000 Marble",
          "vendor": "GL.iNet",
          "versions": [
            {
              "status": "affected",
              "version": "4.x"
            }
          ]
        },
        {
          "modules": [
            "API"
          ],
          "product": "GL-BE3600 Slate 7",
          "vendor": "GL.iNet",
          "versions": [
            {
              "status": "affected",
              "version": "4.x"
            }
          ]
        },
        {
          "modules": [
            "API"
          ],
          "product": "GL-E750",
          "vendor": "GL.iNet",
          "versions": [
            {
              "status": "affected",
              "version": "4.x"
            }
          ]
        },
        {
          "modules": [
            "API"
          ],
          "product": "GL-E750V2 Mudi",
          "vendor": "GL.iNet",
          "versions": [
            {
              "status": "affected",
              "version": "4.x"
            }
          ]
        },
        {
          "modules": [
            "API"
          ],
          "product": "GL-MT300N-V2 Mango",
          "vendor": "GL.iNet",
          "versions": [
            {
              "status": "affected",
              "version": "4.x"
            }
          ]
        },
        {
          "modules": [
            "API"
          ],
          "product": "GL-MT1300 Beryl",
          "vendor": "GL.iNet",
          "versions": [
            {
              "status": "affected",
              "version": "4.x"
            }
          ]
        },
        {
          "modules": [
            "API"
          ],
          "product": "GL-MT2500 Brume 2",
          "vendor": "GL.iNet",
          "versions": [
            {
              "status": "affected",
              "version": "4.x"
            }
          ]
        },
        {
          "modules": [
            "API"
          ],
          "product": "GL-MT3000 Beryl AX",
          "vendor": "GL.iNet",
          "versions": [
            {
              "status": "affected",
              "version": "4.x"
            }
          ]
        },
        {
          "modules": [
            "API"
          ],
          "product": "GL-MT6000 Flint 2",
          "vendor": "GL.iNet",
          "versions": [
            {
              "status": "affected",
              "version": "4.x"
            }
          ]
        },
        {
          "modules": [
            "API"
          ],
          "product": "GL-SFT1200 Opal",
          "vendor": "GL.iNet",
          "versions": [
            {
              "status": "affected",
              "version": "4.x"
            }
          ]
        },
        {
          "modules": [
            "API"
          ],
          "product": "GL-X300B Collie",
          "vendor": "GL.iNet",
          "versions": [
            {
              "status": "affected",
              "version": "4.x"
            }
          ]
        },
        {
          "modules": [
            "API"
          ],
          "product": "GL-X750 Spitz",
          "vendor": "GL.iNet",
          "versions": [
            {
              "status": "affected",
              "version": "4.x"
            }
          ]
        },
        {
          "modules": [
            "API"
          ],
          "product": "GL-X3000 Spitz AX",
          "vendor": "GL.iNet",
          "versions": [
            {
              "status": "affected",
              "version": "4.x"
            }
          ]
        },
        {
          "modules": [
            "API"
          ],
          "product": "GL-XE300 Puli",
          "vendor": "GL.iNet",
          "versions": [
            {
              "status": "affected",
              "version": "4.x"
            }
          ]
        },
        {
          "modules": [
            "API"
          ],
          "product": "GL-XE3000 Puli AX",
          "vendor": "GL.iNet",
          "versions": [
            {
              "status": "affected",
              "version": "4.x"
            }
          ]
        }
      ],
      "source": "cna@vuldb.com"
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "A vulnerability was found in GL.iNet GL-A1300 Slate Plus, GL-AR300M16 Shadow, GL-AR300M Shadow, GL-AR750 Creta, GL-AR750S-EXT Slate, GL-AX1800 Flint, GL-AXT1800 Slate AX, GL-B1300 Convexa-B, GL-B3000 Marble, GL-BE3600 Slate 7, GL-E750, GL-E750V2 Mudi, GL-MT300N-V2 Mango, GL-MT1300 Beryl, GL-MT2500 Brume 2, GL-MT3000 Beryl AX, GL-MT6000 Flint 2, GL-SFT1200 Opal, GL-X300B Collie, GL-X750 Spitz, GL-X3000 Spitz AX, GL-XE300 Puli and GL-XE3000 Puli AX 4.x. It has been declared as problematic. This vulnerability affects unknown code of the component API. The manipulation leads to inefficient regular expression complexity. It is recommended to upgrade the affected component."
    },
    {
      "lang": "es",
      "value": "Se encontr\u00f3 una vulnerabilidad en GL.iNet GL-A1300 Slate Plus, GL-AR300M16 Shadow, GL-AR300M Shadow, GL-AR750 Creta, GL-AR750S-EXT Slate, GL-AX1800 Flint, GL-AXT1800 Slate AX, GL-B1300 Convexa-B, GL-B3000 Marble, GL-BE3600 Slate 7, GL-E750, GL-E750V2 Mudi, GL-MT300N-V2 Mango, GL-MT1300 Beryl, GL-MT2500 Brume 2, GL-MT3000 Beryl AX, GL-MT6000 Flint 2, GL-SFT1200 Opal, GL-X300B Collie, GL-X750 Spitz, GL-X3000 Spitz AX. GL-XE300 Puli y GL-XE3000 Puli AX 4.x. Se ha declarado como problem\u00e1tica. Esta vulnerabilidad afecta a c\u00f3digo desconocido de la API del componente. La manipulaci\u00f3n genera una complejidad ineficiente en las expresiones regulares. Se recomienda actualizar el componente afectado."
    }
  ],
  "id": "CVE-2025-2811",
  "lastModified": "2026-06-17T09:07:39.567",
  "metrics": {
    "cvssMetricV2": [
      {
        "acInsufInfo": false,
        "baseSeverity": "MEDIUM",
        "cvssData": {
          "accessComplexity": "LOW",
          "accessVector": "ADJACENT_NETWORK",
          "authentication": "SINGLE",
          "availabilityImpact": "COMPLETE",
          "baseScore": 5.5,
          "confidentialityImpact": "NONE",
          "integrityImpact": "NONE",
          "vectorString": "AV:A/AC:L/Au:S/C:N/I:N/A:C",
          "version": "2.0"
        },
        "exploitabilityScore": 5.1,
        "impactScore": 6.9,
        "obtainAllPrivilege": false,
        "obtainOtherPrivilege": false,
        "obtainUserPrivilege": false,
        "source": "cna@vuldb.com",
        "type": "Secondary",
        "userInteractionRequired": false
      }
    ],
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "ADJACENT_NETWORK",
          "availabilityImpact": "HIGH",
          "baseScore": 5.7,
          "baseSeverity": "MEDIUM",
          "confidentialityImpact": "NONE",
          "integrityImpact": "NONE",
          "privilegesRequired": "LOW",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
          "version": "3.1"
        },
        "exploitabilityScore": 2.1,
        "impactScore": 3.6,
        "source": "cna@vuldb.com",
        "type": "Secondary"
      }
    ],
    "cvssMetricV40": [
      {
        "cvssData": {
          "Automatable": "NOT_DEFINED",
          "Recovery": "NOT_DEFINED",
          "Safety": "NOT_DEFINED",
          "attackComplexity": "LOW",
          "attackRequirements": "NONE",
          "attackVector": "ADJACENT",
          "availabilityRequirement": "NOT_DEFINED",
          "baseScore": 6.9,
          "baseSeverity": "MEDIUM",
          "confidentialityRequirement": "NOT_DEFINED",
          "exploitMaturity": "NOT_DEFINED",
          "integrityRequirement": "NOT_DEFINED",
          "modifiedAttackComplexity": "NOT_DEFINED",
          "modifiedAttackRequirements": "NOT_DEFINED",
          "modifiedAttackVector": "NOT_DEFINED",
          "modifiedPrivilegesRequired": "NOT_DEFINED",
          "modifiedSubAvailabilityImpact": "NOT_DEFINED",
          "modifiedSubConfidentialityImpact": "NOT_DEFINED",
          "modifiedSubIntegrityImpact": "NOT_DEFINED",
          "modifiedUserInteraction": "NOT_DEFINED",
          "modifiedVulnAvailabilityImpact": "NOT_DEFINED",
          "modifiedVulnConfidentialityImpact": "NOT_DEFINED",
          "modifiedVulnIntegrityImpact": "NOT_DEFINED",
          "privilegesRequired": "LOW",
          "providerUrgency": "NOT_DEFINED",
          "subAvailabilityImpact": "NONE",
          "subConfidentialityImpact": "NONE",
          "subIntegrityImpact": "NONE",
          "userInteraction": "NONE",
          "valueDensity": "NOT_DEFINED",
          "vectorString": "CVSS:4.0/AV:A/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
          "version": "4.0",
          "vulnAvailabilityImpact": "HIGH",
          "vulnConfidentialityImpact": "NONE",
          "vulnIntegrityImpact": "NONE",
          "vulnerabilityResponseEffort": "NOT_DEFINED"
        },
        "source": "cna@vuldb.com",
        "type": "Secondary"
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2025-2811",
          "options": [
            {
              "exploitation": "poc"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "timestamp": "2025-04-28T18:07:38.354152Z",
          "version": "2.0.3"
        }
      }
    ]
  },
  "published": "2025-04-26T07:15:15.380",
  "references": [
    {
      "source": "cna@vuldb.com",
      "url": "https://github.com/gl-inet/CVE-issues/blob/main/4.0.0/Calling%20a%20special%20API%20that%20doesn\u0027t%20require%20login%20and%20passing%20in%20a%20special%20character%20parameter%20results%20in%20100%25%20CPU%20usage.md"
    },
    {
      "source": "cna@vuldb.com",
      "url": "https://vuldb.com/?ctiid.306286"
    },
    {
      "source": "cna@vuldb.com",
      "url": "https://vuldb.com/?id.306286"
    },
    {
      "source": "cna@vuldb.com",
      "url": "https://vuldb.com/?submit.524459"
    },
    {
      "source": "cna@vuldb.com",
      "url": "https://www.gl-inet.com/security-updates/security-advisories-vulnerabilities-and-cves-apr-24-2025/"
    },
    {
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "url": "https://github.com/gl-inet/CVE-issues/blob/main/4.0.0/Calling%20a%20special%20API%20that%20doesn\u0027t%20require%20login%20and%20passing%20in%20a%20special%20character%20parameter%20results%20in%20100%25%20CPU%20usage.md"
    }
  ],
  "sourceIdentifier": "cna@vuldb.com",
  "vulnStatus": "Deferred",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-400"
        },
        {
          "lang": "en",
          "value": "CWE-1333"
        }
      ],
      "source": "cna@vuldb.com",
      "type": "Secondary"
    }
  ]
}

GHSA-6W7Q-QWW7-P95W

Vulnerability from github – Published: 2025-04-26 09:30 – Updated: 2025-04-26 09:30

Details

Severity

5.7 (Medium)


                  
                    CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

6.9 (Medium)


                  
                    CVSS:4.0/AV:A/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Show details on source website

JSON

To clipboard

{
  "affected": [],
  "aliases": [
    "CVE-2025-2811"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-400"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2025-04-26T07:15:15Z",
    "severity": "MODERATE"
  },
  "details": "A vulnerability was found in GL.iNet GL-A1300 Slate Plus, GL-AR300M16 Shadow, GL-AR300M Shadow, GL-AR750 Creta, GL-AR750S-EXT Slate, GL-AX1800 Flint, GL-AXT1800 Slate AX, GL-B1300 Convexa-B, GL-B3000 Marble, GL-BE3600 Slate 7, GL-E750, GL-E750V2 Mudi, GL-MT300N-V2 Mango, GL-MT1300 Beryl, GL-MT2500 Brume 2, GL-MT3000 Beryl AX, GL-MT6000 Flint 2, GL-SFT1200 Opal, GL-X300B Collie, GL-X750 Spitz, GL-X3000 Spitz AX, GL-XE300 Puli and GL-XE3000 Puli AX 4.x. It has been declared as problematic. This vulnerability affects unknown code of the component API. The manipulation leads to inefficient regular expression complexity. It is recommended to upgrade the affected component.",
  "id": "GHSA-6w7q-qww7-p95w",
  "modified": "2025-04-26T09:30:23Z",
  "published": "2025-04-26T09:30:23Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-2811"
    },
    {
      "type": "WEB",
      "url": "https://github.com/gl-inet/CVE-issues/blob/main/4.0.0/Calling%20a%20special%20API%20that%20doesn\u0027t%20require%20login%20and%20passing%20in%20a%20special%20character%20parameter%20results%20in%20100%25%20CPU%20usage.md"
    },
    {
      "type": "WEB",
      "url": "https://vuldb.com/?ctiid.306286"
    },
    {
      "type": "WEB",
      "url": "https://vuldb.com/?id.306286"
    },
    {
      "type": "WEB",
      "url": "https://vuldb.com/?submit.524459"
    },
    {
      "type": "WEB",
      "url": "https://www.gl-inet.com/security-updates/security-advisories-vulnerabilities-and-cves-apr-24-2025"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
      "type": "CVSS_V3"
    },
    {
      "score": "CVSS:4.0/AV:A/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
      "type": "CVSS_V4"
    }
  ]
}

JVNDB-2025-004671

Vulnerability from jvndb - Published: 2025-05-12 08:52 - Updated:2025-05-12 08:52

Severity

7.5 (High) - cvssV3_0 - CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Summary

Multiple vulnerabilities in GL-MT2500 and GL-MT2500A

Details

GL-MT2500 and GL-MT2500A provided by GL.iNet contains multiple vulnerabilities listed below.

OS command injection (CWE-78) - CVE-2024-57391
Inefficient regular expression complexity (CWE-1333) - CVE-2025-2811

Chuya Hayakawa and Ryo Kamino of 00One, Inc. reported these vulnerabilities to JPCERT/CC. JPCERT/CC coordinated with the developer.

References

Type

URL

	JVN	https://jvn.jp/en/vu/JVNVU93247159/index.html
	CVE	https://www.cve.org/CVERecord?id=CVE-2024-57391
	CVE	https://www.cve.org/CVERecord?id=CVE-2025-2811
	Inefficient Regular Expression Complexity(CWE-1333)	https://cwe.mitre.org/data/definitions/1333.html
	OS Command Injection(CWE-78)	https://www.ipa.go.jp/en/security/vulnerabilities/cwe.html

Impacted products

Vendor

Product

	GL.iNet	GL-MT2500A firmware
	GL.iNet	GL-MT2500 firmware

Show details on JVN DB website

JSON

To clipboard

{
  "@rdf:about": "https://jvndb.jvn.jp/en/contents/2025/JVNDB-2025-004671.html",
  "dc:date": "2025-05-12T17:52+09:00",
  "dcterms:issued": "2025-05-12T17:52+09:00",
  "dcterms:modified": "2025-05-12T17:52+09:00",
  "description": "GL-MT2500 and GL-MT2500A provided by GL.iNet contains multiple vulnerabilities listed below.\r\n\r\n\u003cul\u003e\r\n\u003cli\u003e\u003cb\u003eOS command injection (CWE-78)\u003c/b\u003e - CVE-2024-57391\u003c/li\u003e\r\n\u003cli\u003e\u003cb\u003eInefficient regular expression complexity (CWE-1333)\u003c/b\u003e -  CVE-2025-2811\u003c/li\u003e\r\n\u003c/ul\u003e\r\n\r\nChuya Hayakawa and Ryo Kamino of 00One, Inc. reported these vulnerabilities to JPCERT/CC.\r\nJPCERT/CC coordinated with the developer.",
  "link": "https://jvndb.jvn.jp/en/contents/2025/JVNDB-2025-004671.html",
  "sec:cpe": [
    {
      "#text": "cpe:/o:gl-inet:gl-mt2500a_firmware",
      "@product": "GL-MT2500A firmware",
      "@vendor": "GL.iNet",
      "@version": "2.2"
    },
    {
      "#text": "cpe:/o:gl-inet:gl-mt2500_firmware",
      "@product": "GL-MT2500 firmware",
      "@vendor": "GL.iNet",
      "@version": "2.2"
    }
  ],
  "sec:cvss": {
    "@score": "7.5",
    "@severity": "High",
    "@type": "Base",
    "@vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
    "@version": "3.0"
  },
  "sec:identifier": "JVNDB-2025-004671",
  "sec:references": [
    {
      "#text": "https://jvn.jp/en/vu/JVNVU93247159/index.html",
      "@id": "JVNVU#93247159",
      "@source": "JVN"
    },
    {
      "#text": "https://www.cve.org/CVERecord?id=CVE-2024-57391",
      "@id": "CVE-2024-57391",
      "@source": "CVE"
    },
    {
      "#text": "https://www.cve.org/CVERecord?id=CVE-2025-2811",
      "@id": "CVE-2025-2811",
      "@source": "CVE"
    },
    {
      "#text": "https://cwe.mitre.org/data/definitions/1333.html",
      "@id": "CWE-1333",
      "@title": "Inefficient Regular Expression Complexity(CWE-1333)"
    },
    {
      "#text": "https://www.ipa.go.jp/en/security/vulnerabilities/cwe.html",
      "@id": "CWE-78",
      "@title": "OS Command Injection(CWE-78)"
    }
  ],
  "title": "Multiple vulnerabilities in GL-MT2500 and GL-MT2500A"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Vulnerability timeline

Sightings and recorded dates, grouped by day · UTC

Order JSON

How durations are calculated

Following the VTEM framework (Black Hat USA 2015), time to patch starts when the vendor or a coordinator was informed, total time to patch at discovery, and disclosure to patch at public disclosure; vendor response time runs from the report to its acknowledgement. Time to exploit and time unpatched start at the earliest discovery or report, falling back to public disclosure. Unpatched time ends at the first recorded patch, or the calculation time when no patch is recorded. Exploitation to patch shows the interval between those two events; a published proof of concept is a public exploit, not exploitation.

Each result shows its source dates. A negative interval means the end event came first; when date-only inputs leave the order open, the result says so. Date-only inputs are approximate. The earliest evidence wins: KEV report dates and sightings are labelled as such. Records describing another vulnerability are listed but never calculated from, and a PoC alone does not establish exploitation. Missing patch evidence does not prove that no patch exists. Filters below change the event list only.

Publication & reservation Sightings KEV catalogs Other timestamps

Loading timeline…

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

CVE-2025-2811 (GCVE-0-2025-2811)

FKIE_CVE-2025-2811

GHSA-6W7Q-QWW7-P95W

JVNDB-2025-004671

Tags

Sightings

Nomenclature

Vulnerability timeline

Related by attack behaviour