CVE-2024-45263

CVE-2024-45263 affects GL.iNet devices: MT6000, MT3000, MT2500, AXT1800, and AX1800 (firmware 4.6.2). The upload interface accepts arbitrary files; when executed by the device, this can cause information leakage and give an attacker complete control. No mitigations or patches are provided in the ...

CVE-2024-45260

CVE-2024-45260 affects GL.iNet devices (MT6000, MT3000, MT2500, AXT1800, AX1800) running version 4.6.2. The issue allows users in unauthorized groups to invoke any interface of the device, leading to full control. Provided sources consistently describe the affected models and version, but do not ...

CVE-2024-45259

An issue in GL.iNet devices (MT6000, MT3000, MT2500, AXT1800, AX1800) running 4.6.2 allows deletion of any file via the download interface by intercepting an HTTP request and altering the filename property. The root cause is manipulation of the filename parameter in the download flow, leading to ...

CVE-2024-45262

GL-iNet devices affected (MT6000, MT3000, MT2500, AXT1800, AX1800) on version 4.6.2 have a vulnerability in the /rpc call where the params parameter allows arbitrary directory traversal, enabling script execution under arbitrary paths. Affected components: the /rpc endpoint’s params parameter. Im...

CVE-2024-45261

GL.iNet devices (MT6000/MT3000/MT2500/AXT1800/AX1800) with firmware 4.6.2 have a flaw where the SID generated for a user is not bound to that user, enabling other users to reuse it for authentication and potentially escalate privileges to full control after bypassing login. Reported by multiple s...