CVE-2024-45262

An issue was discovered on certain GL-iNet devices, including MT6000, MT3000, MT2500, AXT1800, and AX1800 4.6.2. The params parameter in the call method of the /rpc endpoint is vulnerable to arbitrary directory traversal, which enables attackers to execute scripts under any path...

CVE-2024-45260

An issue was discovered on certain GL-iNet devices, including MT6000, MT3000, MT2500, AXT1800, and AX1800 4.6.2. Users who belong to unauthorized groups can invoke any interface of the device, thereby gaining complete control over it...

CVE-2024-45262

An issue was discovered on certain GL-iNet devices, including MT6000, MT3000, MT2500, AXT1800, and AX1800 4.6.2. The params parameter in the call method of the /rpc endpoint is vulnerable to arbitrary directory traversal, which enables attackers to execute scripts under any path...

CVE-2024-45261

An issue was discovered on certain GL-iNet devices, including MT6000, MT3000, MT2500, AXT1800, and AX1800 4.6.2. The SID generated for a specific user is not tied to that user itself, which allows other users to potentially use it for authentication. Once an attacker bypasses the application's...

CVE-2024-45263

An issue was discovered on certain GL-iNet devices, including MT6000, MT3000, MT2500, AXT1800, and AX1800 4.6.2. The upload interface allows the uploading of arbitrary files to the device. Once the device executes the files, it can lead to information leakage, enabling complete control...

CVE-2024-45259

An issue was discovered on certain GL-iNet devices, including MT6000, MT3000, MT2500, AXT1800, and AX1800 4.6.2. By intercepting an HTTP request and changing the filename property in the download interface, any file on the device can be deleted...

CVE-2024-45263

Several GL-iNet devices, including models MT6000 , MT3000 , MT2500 , AXT1800 , and AX1800 running firmware version 4.6.2 , are susceptible to an arbitrary file upload vulnerability. The upload interface lacks sufficient validation, allowing an attacker to upload and execute arbitrary files on the...

CVE-2024-45261

An authentication deficiency exists in the administrator panel of several GL-iNet microprogrammed software routers, including MT6000 , MT3000 , MT2500 , AXT1800 , and AX1800 running version 4.6.2 . The root cause is that the SID generated for a specific user is not uniquely tied to that user, all...

CVE-2024-45260

A security vulnerability was discovered in the microprogrammed software of several GL-iNet devices, including the MT6000, MT3000, MT2500, AXT1800, and AX1800 (version 4.6.2). The issue stems from deficiencies in authentication procedures , allowing users belonging to unauthorized groups to invoke...

CVE-2024-45262

Several GL-iNet devices, including MT6000 , MT3000 , MT2500 , AXT1800 , and AX1800 running firmware version 4.6.2 , are vulnerable to an arbitrary directory traversal flaw. The vulnerability exists in the params parameter within the call method of the /rpc endpoint. An attacker can exploit this i...

PT-2024-31519

Name of the Vulnerable Software and Affected Versions GL-iNet MT6000 version 4.6.2 GL-iNet MT3000 version 4.6.2 GL-iNet MT2500 version 4.6.2 GL-iNet AXT1800 version 4.6.2 GL-iNet AX1800 version 4.6.2 Description An issue was discovered on certain GL-iNet devices. The params parameter in the call...

PT-2024-31515

Name of the Vulnerable Software and Affected Versions GL-iNet devices, including MT6000, MT3000, MT2500, AXT1800, and AX1800 version 4.6.2 Description An issue was discovered that allows deletion of any file on the device by intercepting an HTTP request and modifying the filename property in the...

PT-2024-31520

Name of the Vulnerable Software and Affected Versions GL-iNet MT6000 version 4.6.2 GL-iNet MT3000 version 4.6.2 GL-iNet MT2500 version 4.6.2 GL-iNet AXT1800 version 4.6.2 GL-iNet AX1800 version 4.6.2 Description An issue was discovered on certain GL-iNet devices. The upload interface allows the...

CVE-2024-45263: Unrestricted Upload of File with Dangerous Type

An issue was discovered on certain GL-iNet devices, including MT6000, MT3000, MT2500, AXT1800, and AX1800 4.6.2. The upload interface allows the uploading of arbitrary files to the device. Once the device executes the files, it can lead to information leakage, enabling complete control...

CVE-2024-45262: Improper Limitation of a Pathname to a Restricted Directory

An issue was discovered on certain GL-iNet devices, including MT6000, MT3000, MT2500, AXT1800, and AX1800 4.6.2. The params parameter in the call method of the /rpc endpoint is vulnerable to arbitrary directory traversal, which enables attackers to execute scripts under any path...

CVE-2024-45261: Incorrect Authorization

An issue was discovered on certain GL-iNet devices, including MT6000, MT3000, MT2500, AXT1800, and AX1800 4.6.2. The SID generated for a specific user is not tied to that user itself, which allows other users to potentially use it for authentication. Once an attacker bypasses the application's...

CVE-2024-45260: Incorrect Authorization

An issue was discovered on certain GL-iNet devices, including MT6000, MT3000, MT2500, AXT1800, and AX1800 4.6.2. Users who belong to unauthorized groups can invoke any interface of the device, thereby gaining complete control over it...

CVE-2024-45259

Several GL-iNet devices, including the MT6000 , MT3000 , MT2500 , AXT1800 , and AX1800 running version 4.6.2 , are vulnerable to an arbitrary file deletion flaw. An attacker can exploit this by intercepting an HTTP request and modifying the filename property within the download interface. This al...

CVE-2024-45259: Inadequate Encryption Strength

An issue was discovered on certain GL-iNet devices, including MT6000, MT3000, MT2500, AXT1800, and AX1800 4.6.2. By intercepting an HTTP request and changing the filename property in the download interface, any file on the device can be deleted...

CVE-2024-28077

A denial-of-service issue was discovered on certain GL-iNet devices. Some websites can detect devices exposed to the external network through DDNS, and consequently obtain the IP addresses and ports of devices that are exposed. By using special usernames and special characters such as half...