8.8

CVE-2024-45262

Exploit
An issue was discovered on certain GL-iNet devices, including MT6000, MT3000, MT2500, AXT1800, and AX1800 4.6.2. The params parameter in the call method of the /rpc endpoint is vulnerable to arbitrary directory traversal, which enables attackers to execute scripts under any path.
Verknüpft mit AI von unstrukturierten Daten zu bestehenden CPE der NVD
Diese Information steht angemeldeten Benutzern zur Verfügung. Login Login
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Gl-inet ≫ Mt2500 Firmware Version >= 4.6.2 < 4.6.4
   Gl-inet ≫ Mt2500 Version-
Gl-inet ≫ Axt1800 Firmware Version >= 4.6.2 < 4.6.4
   Gl-inet ≫ Axt1800 Version-
Gl-inet ≫ Ax1800 Firmware Version >= 4.6.2 < 4.6.4
   Gl-inet ≫ Ax1800 Version-
Gl-inet ≫ B3000 Firmware Version4.5.18
   Gl-inet ≫ B3000 Version-
Gl-inet ≫ A1300 Firmware Version4.5.17
   Gl-inet ≫ A1300 Version-
Gl-inet ≫ X300b Firmware Version4.5.17
   Gl-inet ≫ X300b Version-
Gl-inet ≫ X3000 Firmware Version4.4.9
   Gl-inet ≫ X3000 Version-
Gl-inet ≫ Xe3000 Firmware Version4.4.9
   Gl-inet ≫ Xe3000 Version-
Gl-inet ≫ X750 Firmware Version4.3.18
   Gl-inet ≫ X750 Version-
Gl-inet ≫ Sft1200 Firmware Version4.3.18
   Gl-inet ≫ Sft1200 Version-
Gl-inet ≫ Mt1300 Firmware Version4.3.18
   Gl-inet ≫ Mt1300 Version-
Gl-inet ≫ E750 Firmware Version4.3.17
   Gl-inet ≫ E750 Version-
Gl-inet ≫ Xe300 Firmware Version4.3.17
   Gl-inet ≫ Xe300 Version-
Gl-inet ≫ Ar750 Firmware Version4.3.17
   Gl-inet ≫ Ar750 Version-
Gl-inet ≫ Ar750s Firmware Version4.3.17
   Gl-inet ≫ Ar750s Version-
Gl-inet ≫ Ar300m Firmware Version4.3.17
   Gl-inet ≫ Ar300m Version-
Gl-inet ≫ Mt300n-v2 Firmware Version4.3.17
   Gl-inet ≫ Mt300n-v2 Version-
Gl-inet ≫ Mt6000 Firmware Version4.6.2
   Gl-inet ≫ Mt6000 Version-
Gl-inet ≫ B1300 Firmware Version4.3.17
   Gl-inet ≫ B1300 Version-
Gl-inet ≫ Mt3000 Firmware Version4.6.2
   Gl-inet ≫ Gl-mt3000 Version-
Gl-inet ≫ Ar300m16 Firmware Version4.3.17
   Gl-inet ≫ Ar300m16 Version-
Zu dieser CVE wurde keine CISA KEV oder CERT.AT-Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 0.1% 0.274
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
134c704f-9b21-4f2e-91b3-4a467353bcc0 8.8 2.8 5.9
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.