CVE-2024-57391

syedaquib77

Vulnerability Alert: Multiple Vulnerabilities in GL-MT2500 and GL-MT2500A Timeline: Disclosure: 2025-05-09, Patch: 2025-04-24 Attribution: Reported by ZeroOne Co., Ltd. (Hayakawa Hiroya, Kamino Ryo) cveId: [CVE-2024-57391, CVE-2025-2811] baseScore: [7.2, 7.5] cvssMetrics: [AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H] cvssSeverity: High EPSS Percentile: Not available exploitMaturity: No specific exploit maturity details available. Recognized vulnerabilities with no detailed public exploit context. affectedVersions: - GL-MT2500 firmware before version 4.7.0 - GL-MT2500A firmware before version 4.7.0 fixedVersions: - Update to fixed versions provided by the vendor, specifically firmware 4.7.0 or later Attack Vectors: - Web interface authenticated OS command injection (CVE-2024-57391) - Unauthenticated HTTP request to cause denial of service (CVE-2025-2811) Summary: Multiple vulnerabilities exist in GL.iNet GL-MT2500 and GL-MT2500A. There are at least two identified vulnerabilities: an OS command injection (CWE-78) and inefficient regular expression usage leading to DoS (CWE-1333). These can allow a logged-in administrator user to execute arbitrary OS commands or an unauthenticated third party to cause a denial of service on the device. Impact Scope: An administrator with web interface access may execute arbitrary OS commands; unauthenticated attackers may cause denial of service on the device. Recommended Actions: - Update GL-MT2500 and GL-MT2500A firmware to version 4.7.0 or later as provided by the vendor to address these vulnerabilities. Related Resources: - https://t.co/75WrqyVsYm - https://t.co/BYTW22KyS9 - https://t.co/tLJhtl6lzt - https://t.co/WddjDIMkt0 Tags: #router #GL.iNet #multiple_vulnerabilities #JPCERT #JVN #Cybersecurity