CVE-2024-27356

An arbitrary file download vulnerability exists in the administrator panel of GL.iNet microprogramming software due to the use of an unreliable search path during the export of logs. Attackers can exploit this flaw to download files, such as logs, and gain unauthorized access to protected informa...

CVE-2024-45263

Several GL-iNet devices, including models MT6000 , MT3000 , MT2500 , AXT1800 , and AX1800 running firmware version 4.6.2 , are susceptible to an arbitrary file upload vulnerability. The upload interface lacks sufficient validation, allowing an attacker to upload and execute arbitrary files on the...

CVE-2024-28077

The CVE-2024-28077 issue is a denial-of-service affecting multiple GL.iNet devices (e.g., MT6000, XE3000, X3000, MT3000, MT2500, AXT1800, AX1800, A1300, S200, X750, SFT1200, MT1300, AR750/AR750S/AR300M/AR300M16, B1300, MT300N-V2, XE300) across listed firmware versions. The root cause is that the ...

CVE-2024-39226

CVE-2024-39226 affects a broad set of GL.iNet routers (AR750/AR750S/AR300M/AR300M16/MT300N-V2/B1300/MT1300/SFT1200/X750, MT3000/MT2500/AXT1800/AX1800/A1300/X300B, XE300/E750/AP1300/S1300, XE3000/X3000) with firmware versions ranging from 4.3.11 to 4.4. The vulnerability allows manipulating router...

CVE-2024-45262

Several GL-iNet devices, including MT6000 , MT3000 , MT2500 , AXT1800 , and AX1800 running firmware version 4.6.2 , are vulnerable to an arbitrary directory traversal flaw. The vulnerability exists in the params parameter within the call method of the /rpc endpoint. An attacker can exploit this i...

CVE-2024-45259

Several GL-iNet devices, including the MT6000 , MT3000 , MT2500 , AXT1800 , and AX1800 running version 4.6.2 , are vulnerable to an arbitrary file deletion flaw. An attacker can exploit this by intercepting an HTTP request and modifying the filename property within the download interface. This al...

CVE-2024-45260

A security vulnerability was discovered in the microprogrammed software of several GL-iNet devices, including the MT6000, MT3000, MT2500, AXT1800, and AX1800 (version 4.6.2). The issue stems from deficiencies in authentication procedures , allowing users belonging to unauthorized groups to invoke...

CVE-2024-39229

GL.iNet device family including AR750/AR750S/AR300M/AR300M16/MT300N-V2/B1300/MT1300/SFT1200/X750 v4.3.x, MT3000/MT2500/AXT1800/AX1800/A1300/X300B v4.x, XE300, E750, AP1300/S1300, XE3000/X3000, B2200/MV1000/MV1000W/USB150/N300/SF1200 (and related variants) are documented as having a vulnerability ...

CVE-2024-45261

An authentication deficiency exists in the administrator panel of several GL-iNet microprogrammed software routers, including MT6000 , MT3000 , MT2500 , AXT1800 , and AX1800 running version 4.6.2 . The root cause is that the SID generated for a specific user is not uniquely tied to that user, all...

CVE-2024-39228

GL.iNet firmware for multiple models (AR750/AR750S/AR300M/AR300M16/MT300N-V2/B1300/MT1300/SFT1200/X750 v4.3.11; MT3000/MT2500/AXT1800/AX1800/A1300/X300B v4.5.16; XE300 v4.3.16; E750 v4.3.12; AP1300/S1300 v4.3.13; XE3000/X3000 v4.4) contains a shell injection vulnerability via the interfaces check...

CVE-2024-39225

The CVE-2024-39225 entry concerns a remote code execution (RCE) vulnerability reported in GL.iNet products. Affected devices include AR750/AR750S/AR300M/AR300M16/MT300N-V2/B1300/MT1300/SFT1200/X750 v4.3.11, MT3000/MT2500/AXT1800/AX1800/A1300/X300B v4.5.16, XE300 v4.3.16, E750 v4.3.12, AP1300/S130...

CVE-2024-39227

CVE-2024-39227 affects GL.iNet routers (AR750/AR750S/AR300M/AR300M16/MT300N-V2/B1300/MT1300/SFT1200/X750 v4.3.11; MT3000/MT2500/AXT1800/AX1800/A1300/X300B v4.5.16; XE300 v4.3.16; E750 v4.3.12; AP1300/S1300 v4.3.13; XE3000/X3000 v4.4). An insecure permission issue in endpoint /cgi-bin/glc allows u...