CVE-2024-39227
Critical
Description
GL-iNet products AR750/AR750S/AR300M/AR300M16/MT300N-V2/B1300/MT1300/SFT1200/X750 v4.3.11, MT3000/MT2500/AXT1800/AX1800/A1300/X300B v4.5.16, XE300 v4.3.16, E750 v4.3.12, AP1300/S1300 v4.3.13, and XE3000/X3000 v4.4 were discovered to contain insecure permissions in the endpoint /cgi-bin/glc. This vulnerability allows unauthenticated attackers to execute arbitrary code or possibly a directory traversal via crafted JSON data.
SeverityCritical
CVSS9.8
Exploit probability—
ProductGl-inet A1300 Firmware
PublishedAug 6, 2024
First seenAug 6, 2024
Weakness typeCWE-75CWE-75
How to fix
Sources list no fixed version or patch link for this vulnerability.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| gl-inet a1300_firmware | 4.5.16 | — |
| gl-inet mt6000_firmware | 4.5.8 | — |
| gl-inet x300b_firmware | 4.5.16 | — |
| gl-inet ax1800_firmware | 4.5.16 | — |
| gl-inet axt1800_firmware | 4.5.16 | — |
| gl-inet mt2500_firmware | 4.5.16 | — |
| gl-inet mt3000_firmware | 4.5.16 | — |
| gl-inet x3000_firmware | 4.4.8 | — |
| gl-inet xe3000_firmware | 4.4.8 | — |
| gl-inet xe300_firmware | 4.3.16 | — |
| gl-inet e750_firmware | 4.3.12 | — |
| gl-inet x750_firmware | 4.3.11 | — |
| gl-inet sft1200_firmware | 4.3.11 | — |
| gl-inet ar300m_firmware | 4.3.11 | — |
| gl-inet ar300m16_firmware | 4.3.11 | — |
| gl-inet ar750_firmware | 4.3.11 | — |
| gl-inet ar750s_firmware | 4.3.11 | — |
| gl-inet b1300_firmware | 4.3.11 | — |
| gl-inet mt1300_firmware | 4.3.11 | — |
| gl-inet mt300n-v2_firmware | 4.3.11 | — |
| gl-inet ap1300_firmware | 3.217 | — |
| gl-inet b2200_firmware | 3.216 | — |
| gl-inet mv1000_firmware | 3.216 | — |
| gl-inet mv1000w_firmware | 3.216 | — |
| gl-inet usb150_firmware | 3.216 | — |
| gl-inet sf1200_firmware | 3.216 | — |
| gl-inet n300_firmware | 3.216 | — |
| gl-inet s1300_firmware | 3.216 | — |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.