CVE-2024-27356

🗓️ 27 Feb 2024 00:00:00Reported by mitreType

cve🔗 web.nvd.nist.gov👁 3624 Views🌐 WEB

An issue on GL-iNet devices allows attackers to download files, potentially obtaining critical user information. Affects various MT6000, XE3000, X3000, and other models

Reporter	Title	Published	Views	Family All 13
0day.today	GL.iNet MT6000 4.5.5 - Arbitrary File Download Exploit	2 Apr 202400:00	–	zdt
BDU FSTEC	The vulnerability of the administrator panel of GL.iNet microprogramming software allows a intruder to gain unauthorized access to protected information and upload arbitrary files.	3 Jun 202400:00	–	bdu_fstec
Circl	CVE-2024-27356	27 Feb 202402:21	–	circl
CNNVD	Various GL.iNet products Security Breach	27 Feb 202400:00	–	cnnvd
Cvelist	CVE-2024-27356	27 Feb 202400:00	–	cvelist
Exploit DB	GL-iNet MT6000 4.5.5 - Arbitrary File Download	2 Apr 202400:00	–	exploitdb
EUVD	EUVD-2024-24560	27 Feb 202400:00	–	euvd
NVD	CVE-2024-27356	27 Feb 202401:15	–	nvd
OSV	CVE-2024-27356	27 Feb 202401:15	–	osv
Packet Storm	GL-iNet MT6000 4.5.5 Arbitrary File Download	2 Apr 202400:00	–	packetstorm

NVD

Vulnrichment

Node

gl-inet mt6000_firmwareMatch4.5.5

AND

gl-inet mt6000Match-

Node

gl-inet xe3000_firmwareMatch4.4.4

AND

gl-inet xe3000Match-

Node

gl-inet x3000_firmwareMatch4.4.5

AND

gl-inet x3000Match-

Node

gl-inet mt3000_firmwareMatch4.5.0

AND

gl-inet mt3000Match-

Node

gl-inet mt2500_firmwareMatch4.5.0

AND

gl-inet mt2500Match-

Node

gl-inet axt1800_firmwareMatch4.5.0

AND

gl-inet axt1800Match-

Node

gl-inet ax1800_firmwareMatch4.5.0

AND

gl-inet ax1800Match-

Node

gl-inet a1300_firmwareMatch4.5.0

AND

gl-inet a1300Match-

Node

gl-inet s200_firmwareMatch4.1.4-0300

AND

gl-inet s200Match-

Node

gl-inet x750_firmwareMatch4.3.7

AND

gl-inet x750Match-

Node

gl-inet sft1200_firmwareMatch4.37

AND

gl-inet sft1200Match-

Node

gl-inet xe300_firmwareMatch4.3.7

AND

gl-inet xe300Match-

Node

gl-inet mt1300_firmwareMatch4.3.10

AND

gl-inet mt1300Match-

Node

gl-inet ar750_firmwareMatch4.3.10

AND

gl-inet ar750Match-

Node

gl-inet ar750s_firmwareMatch4.3.10

AND

gl-inet ar750sMatch-

Node

gl-inet ar300m_firmwareMatch4.3.10

AND

gl-inet ar300mMatch-

Node

gl-inet ar300m16_firmwareMatch4.3.10

AND

gl-inet ar300m16Match-

Node

gl-inet b1300_firmwareMatch4.3.10

AND

gl-inet b1300Match-

Node

gl-inet mt300n-v2_firmwareMatch4.3.10

AND

gl-inet mt300n-v2Match-

Node

gl-inet x300b_firmwareMatch3.217

AND

gl-inet x300bMatch-

Node

gl-inet s1300_firmwareMatch3.216

AND

gl-inet s1300Match-

Node

gl-inet sf1200_firmwareMatch3.216

AND

gl-inet sf1200Match-

Node

gl-inet mv1000_firmwareMatch3.216

AND

gl-inet mv1000Match-

Node

gl-inet n300_firmwareMatch3.216

AND

gl-inet n300Match-

Node

gl-inet b2200_firmwareMatch3.216

AND

gl-inet b2200Match-

Node

gl-inet x1200_firmwareMatch3.203

AND

gl-inet x1200Match-

Source	Link
gl-inet	www.gl-inet.com/
github	www.github.com/gl-inet/CVE-issues/blob/main/4.0.0/Download_file_vulnerability.md

Parameter	Position	Path	Description	CWE
jsonrpc	request body	rpc	JSON-RPC based interaction to /rpc used in exploit to query firmware_version and model	CWE-200
id	request body	rpc	JSON-RPC based interaction to /rpc used in exploit to query firmware_version and model	CWE-200
method	request body	rpc	JSON-RPC based interaction to /rpc used in exploit to query firmware_version and model	CWE-200
params	request body	rpc	JSON-RPC based interaction to /rpc used in exploit to query firmware_version and model	CWE-200

17 Jun 2026 07:19Current

6.8Medium risk

Vulners AI Score6.8

CVSS 3.17.5

EPSS0.23905

SSVC

CWE-200