8

CVE-2024-45260

Exploit
An issue was discovered on certain GL-iNet devices, including MT6000, MT3000, MT2500, AXT1800, and AX1800 4.6.2. Users who belong to unauthorized groups can invoke any interface of the device, thereby gaining complete control over it.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Gl-inet ≫ Mt6000 Firmware Version 4.6.2
   Gl-inet ≫ Mt6000 Version -
   Gl-inet ≫ B1300 Version -
Gl-inet ≫ B1300 Firmware Version 4.3.17
   Gl-inet ≫ Mt6000 Version -
   Gl-inet ≫ B1300 Version -
Gl-inet ≫ Mt2500 Firmware Version >= 4.6.2 < 4.6.4
   Gl-inet ≫ Mt2500 Version -
Gl-inet ≫ Axt1800 Firmware Version >= 4.6.2 < 4.6.4
   Gl-inet ≫ Axt1800 Version -
Gl-inet ≫ Ax1800 Firmware Version >= 4.6.2 < 4.6.4
   Gl-inet ≫ Ax1800 Version -
Gl-inet ≫ B3000 Firmware Version 4.5.18
   Gl-inet ≫ B3000 Version -
Gl-inet ≫ A1300 Firmware Version 4.5.17
   Gl-inet ≫ A1300 Version -
Gl-inet ≫ X300b Firmware Version 4.5.17
   Gl-inet ≫ X300b Version -
Gl-inet ≫ X3000 Firmware Version 4.4.9
   Gl-inet ≫ X3000 Version -
Gl-inet ≫ Xe3000 Firmware Version 4.4.9
   Gl-inet ≫ Xe3000 Version -
Gl-inet ≫ X750 Firmware Version 4.3.18
   Gl-inet ≫ X750 Version -
Gl-inet ≫ Sft1200 Firmware Version 4.3.18
   Gl-inet ≫ Sft1200 Version -
Gl-inet ≫ Mt1300 Firmware Version 4.3.18
   Gl-inet ≫ Mt1300 Version -
Gl-inet ≫ E750 Firmware Version 4.3.17
   Gl-inet ≫ E750 Version -
Gl-inet ≫ Xe300 Firmware Version 4.3.17
   Gl-inet ≫ Xe300 Version -
Gl-inet ≫ Ar750 Firmware Version 4.3.17
   Gl-inet ≫ Ar750 Version -
Gl-inet ≫ Ar750s Firmware Version 4.3.17
   Gl-inet ≫ Ar750s Version -
Gl-inet ≫ Ar300m Firmware Version 4.3.17
   Gl-inet ≫ Ar300m Version -
Gl-inet ≫ Mt300n-v2 Firmware Version 4.3.17
   Gl-inet ≫ Mt300n-v2 Version -
Gl-inet ≫ Mt3000 Firmware Version 4.6.2
   Gl-inet ≫ Gl-mt3000 Version -
Gl-inet ≫ Ar300m16 Firmware Version 4.3.17
   Gl-inet ≫ Ar300m16 Version -
VulnDex Vulnerability Enrichment
Diese Information steht angemeldeten Benutzern zur Verfügung. Login Login
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 3.98% 0.895
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
CISA-ADP 8 2.1 5.9
CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CWE-863 Incorrect Authorization

The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.

https://github.com/gl-inet/CVE-issues/blob/main/4.0.0/Unauthorized%20Access%20to%20File%20Download%20and%20Upload%20Interfaces.md
Third Party Advisory
Exploit