CVE-2024-45263

Several GL-iNet devices, including models MT6000 , MT3000 , MT2500 , AXT1800 , and AX1800 running firmware version 4.6.2 , are susceptible to an arbitrary file upload vulnerability. The upload interface lacks sufficient validation, allowing an attacker to upload and execute arbitrary files on the...

CVE-2024-45262

Several GL-iNet devices, including MT6000 , MT3000 , MT2500 , AXT1800 , and AX1800 running firmware version 4.6.2 , are vulnerable to an arbitrary directory traversal flaw. The vulnerability exists in the params parameter within the call method of the /rpc endpoint. An attacker can exploit this i...

CVE-2024-45259

Several GL-iNet devices, including the MT6000 , MT3000 , MT2500 , AXT1800 , and AX1800 running version 4.6.2 , are vulnerable to an arbitrary file deletion flaw. An attacker can exploit this by intercepting an HTTP request and modifying the filename property within the download interface. This al...

CVE-2024-45260

A security vulnerability was discovered in the microprogrammed software of several GL-iNet devices, including the MT6000, MT3000, MT2500, AXT1800, and AX1800 (version 4.6.2). The issue stems from deficiencies in authentication procedures , allowing users belonging to unauthorized groups to invoke...

CVE-2024-45261

An authentication deficiency exists in the administrator panel of several GL-iNet microprogrammed software routers, including MT6000 , MT3000 , MT2500 , AXT1800 , and AX1800 running version 4.6.2 . The root cause is that the SID generated for a specific user is not uniquely tied to that user, all...