Vulnerability-Lookup

BDU:2024-04298 (CVE-2024-27356)

Vulnerability from fstec – Published: 2024-06-03 – Updated: 2024-06-03 – View on bdu.fstec.ru Exploit publicly available Fixed

Title

Уязвимость панели администратора микропрограммного обеспечения маршрутизаторов GL.iNet, позволяющая нарушителю получить несанкционированный доступ к защищаемой информации и загружать произвольные файлы

Summary

Уязвимость панели администратора микропрограммного обеспечения маршрутизаторов GL.iNet связана с использованием ненадёжного пути поиска в процессе экспорта журналов. Эксплуатация уязвимости может позволить нарушителю, действующему удаленно, получить несанкционированный доступ к защищаемой информации и загружать произвольные файлы

Severity

8.5 (High) CVSS 2.0


                      
                        AV:N/AC:L/Au:N/C:C/I:N/A:P

8.2 (High) CVSS 3.0


                      
                        CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:L

Class

Code vulnerability

Status

Confirmed by the vendor

Exploitation

Resource manipulation, Spoofing

Incidents

Being clarified

Remediation

Software update

CWE

CWE-426 - Ненадежный путь поиска
CWE-427 - Неконтролируемый элемент пути поиска

Aliases

CVE-2024-27356, EDB-ID51942

References

4 references

URL
https://www.exploit-db.com/exploits/51942
https://github.com/gl-inet/CVE-issues/blob/main/4.0.0/Download_file_vulnerability.md
https://packetstormsecurity.com/files/177886/GL-iNet-MT6000-4.5.5-Arbitrary-Fil…
https://www.gl-inet.com/security-updates/security-advisories-vulnerabilities-an…

Impacted products

26 products from 1 vendor

Vendors

GL Tech (HK) Ltd.

Products

GL-MT6000, GL-XE3000, GL-X3000, GL-MT3000, GL-MT2500, GL-AXT1800, GL-AX1800, GL-A1300, GL-B1300, GL-MT1300, GL-MT300N-V2, GL-AR750, GL-AR750S, GL-AR300M, GL-S200, GL-X750, GL-SFT1200, GL-XE300, GL-AR300M16, GL-X300B, GL-S1300, GL-SF1200, GL-MV1000, N300, GL-B2200, GL-X1200

Versions

4.5.5 (GL-MT6000), 4.4.4 (GL-XE3000), 4.4.5 (GL-X3000), 4.5.0 (GL-MT3000), 4.5.0 (GL-MT2500), 4.5.0 (GL-AXT1800), 4.5.0 (GL-AX1800), 4.5.0 (GL-A1300), 4.3.10 (GL-B1300), 4.3.10 (GL-MT1300), 4.3.10 (GL-MT300N-V2), 4.3.10 (GL-AR750), 4.3.10 (GL-AR750S), 4.3.10 (GL-AR300M), 4.1.4-0300 (GL-S200), 4.3.7 (GL-X750), 4.3.7 (GL-SFT1200), 4.3.7 (GL-XE300), 4.3.10 (GL-AR300M16), 3.217 (GL-X300B), 3.216 (GL-S1300), 3.216 (GL-SF1200), 3.216 (GL-MV1000), 3.216 (N300), 3.216 (GL-B2200), 3.203 (GL-X1200)

Product types

Network device, Network appliance software

Mitigations

JSON

To clipboard

{
  "CVSS 2.0": "AV:N/AC:L/Au:N/C:C/I:N/A:P",
  "CVSS 3.0": "AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:L",
  "CVSS 4.0": null,
  "remediation_\u0418\u0434\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u043e\u0440": null,
  "remediation_\u041d\u0430\u0438\u043c\u0435\u043d\u043e\u0432\u0430\u043d\u0438\u0435": null,
  "\u0412\u0435\u043d\u0434\u043e\u0440 \u041f\u041e": "GL Tech (HK) Ltd.",
  "\u0412\u0435\u0440\u0441\u0438\u044f \u041f\u041e": "4.5.5 (GL-MT6000), 4.4.4 (GL-XE3000), 4.4.5 (GL-X3000), 4.5.0 (GL-MT3000), 4.5.0 (GL-MT2500), 4.5.0 (GL-AXT1800), 4.5.0 (GL-AX1800), 4.5.0 (GL-A1300), 4.3.10 (GL-B1300), 4.3.10 (GL-MT1300), 4.3.10 (GL-MT300N-V2), 4.3.10 (GL-AR750), 4.3.10 (GL-AR750S), 4.3.10 (GL-AR300M), 4.1.4-0300 (GL-S200), 4.3.7 (GL-X750), 4.3.7 (GL-SFT1200), 4.3.7 (GL-XE300), 4.3.10 (GL-AR300M16), 3.217 (GL-X300B), 3.216 (GL-S1300), 3.216 (GL-SF1200), 3.216 (GL-MV1000), 3.216 (N300), 3.216 (GL-B2200), 3.203 (GL-X1200)",
  "\u0412\u043e\u0437\u043c\u043e\u0436\u043d\u044b\u0435 \u043c\u0435\u0440\u044b \u043f\u043e \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0438\u044e": "\u0418\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u0435 \u0440\u0435\u043a\u043e\u043c\u0435\u043d\u0434\u0430\u0446\u0438\u0439:\nhttps://www.gl-inet.com/security-updates/security-advisories-vulnerabilities-and-cves-apr-29-2024/\n\n\u0414\u043b\u044f GL-MT6000:\nhttps://dl.gl-inet.com/router/mt6000/\n\u0414\u043b\u044f GL-XE3000:\nhttps://dl.gl-inet.com/router/xe3000/\n\u0414\u043b\u044f GL-X3000:\nhttps://dl.gl-inet.com/router/x3000/\n\u0414\u043b\u044f GL-MT3000:\nhttps://dl.gl-inet.com/router/mt3000/\n\u0414\u043b\u044f GL-MT2500:\nhttps://dl.gl-inet.com/router/mt2500/\n\u0414\u043b\u044f GL-AXT1800:\nhttps://dl.gl-inet.com/router/axt1800/\n\u0414\u043b\u044f GL-AX1800:\nhttps://dl.gl-inet.com/router/ax1800/\n\u0414\u043b\u044f GL-A1300:\nhttps://dl.gl-inet.com/router/a1300/\n\u0414\u043b\u044f GL-S200:\nhttps://dl.gl-inet.com/iot/s200/\n\u0414\u043b\u044f GL-X750:\nhttps://dl.gl-inet.com/router/x750/\n\u0414\u043b\u044f GL-SFT1200:\nhttps://dl.gl-inet.com/router/sft1200/\n\u0414\u043b\u044f GL-XE300:\nhttps://dl.gl-inet.com/router/xe300/\n\u0414\u043b\u044f GL-MT1300:\nhttps://dl.gl-inet.com/router/mt1300/\n\u0414\u043b\u044f GL-AR750:\nhttps://dl.gl-inet.com/router/ar750/\n\u0414\u043b\u044f GL-AR750S:\nhttps://dl.gl-inet.com/router/ar750s/\n\u0414\u043b\u044f GL-AR300M:\nhttps://dl.gl-inet.com/router/ar300m/\n\u0414\u043b\u044f GL-AR300M16:\nhttps://dl.gl-inet.com/router/ar300m16/\n\u0414\u043b\u044f GL-B1300:\nhttps://dl.gl-inet.com/router/b1300/\n\u0414\u043b\u044f GL-MT300N-v2:\nhttps://dl.gl-inet.com/router/mt300n-v2/\n\u0414\u043b\u044f GL-X300B:\nhttps://dl.gl-inet.com/router/x300b/\n\u0414\u043b\u044f GL-S1300:\nhttps://dl.gl-inet.com/router/s1300/\n\u0414\u043b\u044f GL-SF1200:\nhttps://dl.gl-inet.com/router/sf1200/\n\u0414\u043b\u044f GL-MV1000:\nhttps://dl.gl-inet.com/router/mv1000/\n\u0414\u043b\u044f N300:\nhttps://dl.gl-inet.com/router/n300/\n\u0414\u043b\u044f GL-B2200:\nhttps://dl.gl-inet.com/router/b2200/\n\u0414\u043b\u044f GL-X1200:\nhttps://dl.gl-inet.com/router/x1200/",
  "\u0414\u0430\u0442\u0430 \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0438\u044f": "26.02.2024",
  "\u0414\u0430\u0442\u0430 \u043f\u043e\u0441\u043b\u0435\u0434\u043d\u0435\u0433\u043e \u043e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u044f": "03.06.2024",
  "\u0414\u0430\u0442\u0430 \u043f\u0443\u0431\u043b\u0438\u043a\u0430\u0446\u0438\u0438": "03.06.2024",
  "\u0418\u0434\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u043e\u0440": "BDU:2024-04298",
  "\u0418\u0434\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u043e\u0440\u044b \u0434\u0440\u0443\u0433\u0438\u0445 \u0441\u0438\u0441\u0442\u0435\u043c \u043e\u043f\u0438\u0441\u0430\u043d\u0438\u0439 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "CVE-2024-27356, EDB-ID51942",
  "\u0418\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u044f \u043e\u0431 \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0438\u0438": "\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0430",
  "\u041a\u043b\u0430\u0441\u0441 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u043a\u043e\u0434\u0430",
  "\u041d\u0430\u0437\u0432\u0430\u043d\u0438\u0435 \u041f\u041e": "GL-MT6000, GL-XE3000, GL-X3000, GL-MT3000, GL-MT2500, GL-AXT1800, GL-AX1800, GL-A1300, GL-B1300, GL-MT1300, GL-MT300N-V2, GL-AR750, GL-AR750S, GL-AR300M, GL-S200, GL-X750, GL-SFT1200, GL-XE300, GL-AR300M16, GL-X300B, GL-S1300, GL-SF1200, GL-MV1000, N300, GL-B2200, GL-X1200",
  "\u041d\u0430\u0438\u043c\u0435\u043d\u043e\u0432\u0430\u043d\u0438\u0435 \u041e\u0421 \u0438 \u0442\u0438\u043f \u0430\u043f\u043f\u0430\u0440\u0430\u0442\u043d\u043e\u0439 \u043f\u043b\u0430\u0442\u0444\u043e\u0440\u043c\u044b": null,
  "\u041d\u0430\u0438\u043c\u0435\u043d\u043e\u0432\u0430\u043d\u0438\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u043f\u0430\u043d\u0435\u043b\u0438 \u0430\u0434\u043c\u0438\u043d\u0438\u0441\u0442\u0440\u0430\u0442\u043e\u0440\u0430 \u043c\u0438\u043a\u0440\u043e\u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u043d\u043e\u0433\u043e \u043e\u0431\u0435\u0441\u043f\u0435\u0447\u0435\u043d\u0438\u044f \u043c\u0430\u0440\u0448\u0440\u0443\u0442\u0438\u0437\u0430\u0442\u043e\u0440\u043e\u0432 GL.iNet, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0430\u044f \u043d\u0430\u0440\u0443\u0448\u0438\u0442\u0435\u043b\u044e \u043f\u043e\u043b\u0443\u0447\u0438\u0442\u044c \u043d\u0435\u0441\u0430\u043d\u043a\u0446\u0438\u043e\u043d\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u044b\u0439 \u0434\u043e\u0441\u0442\u0443\u043f \u043a \u0437\u0430\u0449\u0438\u0449\u0430\u0435\u043c\u043e\u0439 \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u0438 \u0438 \u0437\u0430\u0433\u0440\u0443\u0436\u0430\u0442\u044c \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u043b\u044c\u043d\u044b\u0435 \u0444\u0430\u0439\u043b\u044b",
  "\u041d\u0430\u043b\u0438\u0447\u0438\u0435 \u044d\u043a\u0441\u043f\u043b\u043e\u0439\u0442\u0430": "\u0421\u0443\u0449\u0435\u0441\u0442\u0432\u0443\u0435\u0442 \u0432 \u043e\u0442\u043a\u0440\u044b\u0442\u043e\u043c \u0434\u043e\u0441\u0442\u0443\u043f\u0435",
  "\u041e\u043f\u0438\u0441\u0430\u043d\u0438\u0435 \u043e\u0448\u0438\u0431\u043a\u0438 CWE": "\u041d\u0435\u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u043f\u0443\u0442\u044c \u043f\u043e\u0438\u0441\u043a\u0430 (CWE-426), \u041d\u0435\u043a\u043e\u043d\u0442\u0440\u043e\u043b\u0438\u0440\u0443\u0435\u043c\u044b\u0439 \u044d\u043b\u0435\u043c\u0435\u043d\u0442 \u043f\u0443\u0442\u0438 \u043f\u043e\u0438\u0441\u043a\u0430 (CWE-427)",
  "\u041e\u043f\u0438\u0441\u0430\u043d\u0438\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u043f\u0430\u043d\u0435\u043b\u0438 \u0430\u0434\u043c\u0438\u043d\u0438\u0441\u0442\u0440\u0430\u0442\u043e\u0440\u0430 \u043c\u0438\u043a\u0440\u043e\u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u043d\u043e\u0433\u043e \u043e\u0431\u0435\u0441\u043f\u0435\u0447\u0435\u043d\u0438\u044f \u043c\u0430\u0440\u0448\u0440\u0443\u0442\u0438\u0437\u0430\u0442\u043e\u0440\u043e\u0432 GL.iNet \u0441\u0432\u044f\u0437\u0430\u043d\u0430 \u0441 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u0435\u043c \u043d\u0435\u043d\u0430\u0434\u0451\u0436\u043d\u043e\u0433\u043e \u043f\u0443\u0442\u0438 \u043f\u043e\u0438\u0441\u043a\u0430 \u0432 \u043f\u0440\u043e\u0446\u0435\u0441\u0441\u0435 \u044d\u043a\u0441\u043f\u043e\u0440\u0442\u0430 \u0436\u0443\u0440\u043d\u0430\u043b\u043e\u0432. \u042d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u043c\u043e\u0436\u0435\u0442 \u043f\u043e\u0437\u0432\u043e\u043b\u0438\u0442\u044c \u043d\u0430\u0440\u0443\u0448\u0438\u0442\u0435\u043b\u044e, \u0434\u0435\u0439\u0441\u0442\u0432\u0443\u044e\u0449\u0435\u043c\u0443 \u0443\u0434\u0430\u043b\u0435\u043d\u043d\u043e, \u043f\u043e\u043b\u0443\u0447\u0438\u0442\u044c \u043d\u0435\u0441\u0430\u043d\u043a\u0446\u0438\u043e\u043d\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u044b\u0439 \u0434\u043e\u0441\u0442\u0443\u043f \u043a \u0437\u0430\u0449\u0438\u0449\u0430\u0435\u043c\u043e\u0439 \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u0438 \u0438 \u0437\u0430\u0433\u0440\u0443\u0436\u0430\u0442\u044c \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u043b\u044c\u043d\u044b\u0435 \u0444\u0430\u0439\u043b\u044b",
  "\u041f\u043e\u0441\u043b\u0435\u0434\u0441\u0442\u0432\u0438\u044f \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u0438 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": null,
  "\u041f\u0440\u043e\u0447\u0430\u044f \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u044f": null,
  "\u0421\u0432\u044f\u0437\u044c \u0441 \u0438\u043d\u0446\u0438\u0434\u0435\u043d\u0442\u0430\u043c\u0438 \u0418\u0411": "\u0414\u0430\u043d\u043d\u044b\u0435 \u0443\u0442\u043e\u0447\u043d\u044f\u044e\u0442\u0441\u044f",
  "\u0421\u043e\u0441\u0442\u043e\u044f\u043d\u0438\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "\u041e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043d\u0430",
  "\u0421\u043f\u043e\u0441\u043e\u0431 \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0438\u044f": "\u041e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u0435 \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u043d\u043e\u0433\u043e \u043e\u0431\u0435\u0441\u043f\u0435\u0447\u0435\u043d\u0438\u044f",
  "\u0421\u043f\u043e\u0441\u043e\u0431 \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u0438": "\u041c\u0430\u043d\u0438\u043f\u0443\u043b\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u0435 \u0440\u0435\u0441\u0443\u0440\u0441\u0430\u043c\u0438, \u041f\u043e\u0434\u043c\u0435\u043d\u0430 \u043f\u0440\u0438 \u0432\u0437\u0430\u0438\u043c\u043e\u0434\u0435\u0439\u0441\u0442\u0432\u0438\u0438",
  "\u0421\u0441\u044b\u043b\u043a\u0438 \u043d\u0430 \u0438\u0441\u0442\u043e\u0447\u043d\u0438\u043a\u0438": "https://www.exploit-db.com/exploits/51942\nhttps://github.com/gl-inet/CVE-issues/blob/main/4.0.0/Download_file_vulnerability.md\nhttps://packetstormsecurity.com/files/177886/GL-iNet-MT6000-4.5.5-Arbitrary-File-Download.html\nhttps://www.gl-inet.com/security-updates/security-advisories-vulnerabilities-and-cves-apr-29-2024/",
  "\u0421\u0442\u0430\u0442\u0443\u0441 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "\u041f\u043e\u0434\u0442\u0432\u0435\u0440\u0436\u0434\u0435\u043d\u0430 \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u0434\u0438\u0442\u0435\u043b\u0435\u043c",
  "\u0422\u0438\u043f \u041f\u041e": "\u0421\u0435\u0442\u0435\u0432\u043e\u0435 \u0441\u0440\u0435\u0434\u0441\u0442\u0432\u043e, \u041f\u041e \u0441\u0435\u0442\u0435\u0432\u043e\u0433\u043e \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u043d\u043e-\u0430\u043f\u043f\u0430\u0440\u0430\u0442\u043d\u043e\u0433\u043e \u0441\u0440\u0435\u0434\u0441\u0442\u0432\u0430",
  "\u0422\u0438\u043f \u043e\u0448\u0438\u0431\u043a\u0438 CWE": "CWE-426, CWE-427",
  "\u0423\u0440\u043e\u0432\u0435\u043d\u044c \u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "\u0412\u044b\u0441\u043e\u043a\u0438\u0439 \u0443\u0440\u043e\u0432\u0435\u043d\u044c \u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 (\u0431\u0430\u0437\u043e\u0432\u0430\u044f \u043e\u0446\u0435\u043d\u043a\u0430 CVSS 2.0 \u0441\u043e\u0441\u0442\u0430\u0432\u043b\u044f\u0435\u0442 8,5)\n\u0412\u044b\u0441\u043e\u043a\u0438\u0439 \u0443\u0440\u043e\u0432\u0435\u043d\u044c \u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 (\u0431\u0430\u0437\u043e\u0432\u0430\u044f \u043e\u0446\u0435\u043d\u043a\u0430 CVSS 3.0 \u0441\u043e\u0441\u0442\u0430\u0432\u043b\u044f\u0435\u0442 8,2)"
}

CVE-2024-27356 (GCVE-0-2024-27356)

Vulnerability from cvelistv5 – Published: 2024-02-27 00:00 – Updated: 2025-03-24 15:44

Summary

An issue was discovered on certain GL-iNet devices. Attackers can download files such as logs via commands, potentially obtaining critical user information. This affects MT6000 4.5.5, XE3000 4.4.4, X3000 4.4.5, MT3000 4.5.0, MT2500 4.5.0, AXT1800 4.5.0, AX1800 4.5.0, A1300 4.5.0, S200 4.1.4-0300, X750 4.3.7, SFT1200 4.3.7, XE300 4.3.7, MT1300 4.3.10, AR750 4.3.10, AR750S 4.3.10, AR300M 4.3.10, AR300M16 4.3.10, B1300 4.3.10, MT300N-v2 4.3.10, X300B 3.217, S1300 3.216, SF1200 3.216, MV1000 3.216, N300 3.216, B2200 3.216, and X1200 3.203.

Severity

7.5 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

SSVC

Exploitation: none Automatable: yes Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2024-02-27 15:51 UTC

CWE

n/a
CWE-200 - Exposure of Sensitive Information to an Unauthorized Actor

Assigner

mitre mitre root

References

2 references

URL	Tags
https://gl-inet.com
https://github.com/gl-inet/CVE-issues/blob/main/4…

Impacted products

27 products

Vendor	Product	Version
gl-inet	mt1300	Affected: 4.3.10 cpe:2.3:a:gl-inet:mt1300:4.3.10:::::::*
gl-inet	ar750	Affected: 4.3.10 cpe:2.3:a:gl-inet:ar750:4.3.10:::::::*
gl-inet	ar750s	Affected: 4.3.10 cpe:2.3:a:gl-inet:ar750s:4.3.10:::::::*
gl.inet	MT6000	Affected: 4.5.5 cpe:2.3:h:gl.inet:MT6000:-:::::::*
gl-inet	xe3000	Affected: 4.4.4 cpe:2.3:a:gl-inet:xe3000:4.4.4:::::::*
gl-inet	x3000	Affected: 4.4.5 cpe:2.3:a:gl-inet:x3000:4.4.5:::::::*
gl-inet	mt3000	Affected: 4.5.0 cpe:2.3:a:gl-inet:mt3000:4.5.0:::::::*
gl-inet	mt2500	Affected: 4.5.0 cpe:2.3:a:gl-inet:mt2500:4.5.0:::::::*
gl-inet	axt1800	Affected: 4.5.0 cpe:2.3:a:gl-inet:axt1800:4.5.0:::::::*
gl-inet	ax1800	Affected: 4.5.0 cpe:2.3:a:gl-inet:ax1800:4.5.0:::::::*
gl-inet	a1300	Affected: 4.5.0 cpe:2.3:a:gl-inet:a1300:4.5.0:::::::*
gl-inet	s200	Affected: 4.1.4 cpe:2.3:a:gl-inet:s200:4.1.4:::::::*
gl-inet	0300	Affected: 4.3.7 cpe:2.3:a:gl-inet:0300::::::::
gl-inet	x750	Affected: 4.3.7 cpe:2.3:a:gl-inet:x750:4.3.7:::::::*
gl-inet	sft1200	Affected: 4.3.7 cpe:2.3:a:gl-inet:sft1200:4.3.7:::::::*
gl-inet	xe300	Affected: 4.3.7 cpe:2.3:a:gl-inet:xe300:4.3.7:::::::*
gl-inet	ar3000m	Affected: 4.3.10 cpe:2.3:a:gl-inet:ar3000m:4.3.10:::::::*
gl-inet	ar3000m16	Affected: 4.3.10 cpe:2.3:a:gl-inet:ar3000m16:4.3.10:::::::*
gl-inet	b1300	Affected: 4.3.10 cpe:2.3:a:gl-inet:b1300:4.3.10:::::::*
gl-inet	mt300nv2	Affected: 4.3.10 cpe:2.3:a:gl-inet:mt300nv2:4.3.10:::::::*
gl-inet	x300b	Affected: 3.217 cpe:2.3:a:gl-inet:x300b:3.217:::::::*
gl-inet	s1300	Affected: 3.216 cpe:2.3:a:gl-inet:s1300:3.216:::::::*
gl-inet	sf1200	Affected: 3.216 cpe:2.3:a:gl-inet:sf1200:3.216:::::::*
gl-inet	mv1000	Affected: 3.216 cpe:2.3:a:gl-inet:mv1000:3.216:::::::*
gl-inet	n300	Affected: 3.216 cpe:2.3:a:gl-inet:n300:3.216:::::::*
gl-inet	b2200	Affected: 3.216 cpe:2.3:a:gl-inet:b2200:3.216:::::::*
gl-i	x1200	Affected: 3.203 cpe:2.3:a:gl-i:x1200:3.203:::::::*

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T00:34:51.986Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://gl-inet.com"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://github.com/gl-inet/CVE-issues/blob/main/4.0.0/Download_file_vulnerability.md"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "affected": [
          {
            "cpes": [
              "cpe:2.3:a:gl-inet:mt1300:4.3.10:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "mt1300",
            "vendor": "gl-inet",
            "versions": [
              {
                "status": "affected",
                "version": "4.3.10"
              }
            ]
          },
          {
            "cpes": [
              "cpe:2.3:a:gl-inet:ar750:4.3.10:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "ar750",
            "vendor": "gl-inet",
            "versions": [
              {
                "status": "affected",
                "version": "4.3.10"
              }
            ]
          },
          {
            "cpes": [
              "cpe:2.3:a:gl-inet:ar750s:4.3.10:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "ar750s",
            "vendor": "gl-inet",
            "versions": [
              {
                "status": "affected",
                "version": "4.3.10"
              }
            ]
          },
          {
            "cpes": [
              "cpe:2.3:h:gl.inet:MT6000:-:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "MT6000",
            "vendor": "gl.inet",
            "versions": [
              {
                "status": "affected",
                "version": "4.5.5"
              }
            ]
          },
          {
            "cpes": [
              "cpe:2.3:a:gl-inet:xe3000:4.4.4:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "xe3000",
            "vendor": "gl-inet",
            "versions": [
              {
                "status": "affected",
                "version": "4.4.4"
              }
            ]
          },
          {
            "cpes": [
              "cpe:2.3:a:gl-inet:x3000:4.4.5:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "x3000",
            "vendor": "gl-inet",
            "versions": [
              {
                "status": "affected",
                "version": "4.4.5"
              }
            ]
          },
          {
            "cpes": [
              "cpe:2.3:a:gl-inet:mt3000:4.5.0:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "mt3000",
            "vendor": "gl-inet",
            "versions": [
              {
                "status": "affected",
                "version": "4.5.0"
              }
            ]
          },
          {
            "cpes": [
              "cpe:2.3:a:gl-inet:mt2500:4.5.0:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "mt2500",
            "vendor": "gl-inet",
            "versions": [
              {
                "status": "affected",
                "version": "4.5.0"
              }
            ]
          },
          {
            "cpes": [
              "cpe:2.3:a:gl-inet:axt1800:4.5.0:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "axt1800",
            "vendor": "gl-inet",
            "versions": [
              {
                "status": "affected",
                "version": "4.5.0"
              }
            ]
          },
          {
            "cpes": [
              "cpe:2.3:a:gl-inet:ax1800:4.5.0:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "ax1800",
            "vendor": "gl-inet",
            "versions": [
              {
                "status": "affected",
                "version": "4.5.0"
              }
            ]
          },
          {
            "cpes": [
              "cpe:2.3:a:gl-inet:a1300:4.5.0:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "a1300",
            "vendor": "gl-inet",
            "versions": [
              {
                "status": "affected",
                "version": "4.5.0"
              }
            ]
          },
          {
            "cpes": [
              "cpe:2.3:a:gl-inet:s200:4.1.4:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "s200",
            "vendor": "gl-inet",
            "versions": [
              {
                "status": "affected",
                "version": "4.1.4"
              }
            ]
          },
          {
            "cpes": [
              "cpe:2.3:a:gl-inet:0300:*:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "0300",
            "vendor": "gl-inet",
            "versions": [
              {
                "status": "affected",
                "version": "4.3.7"
              }
            ]
          },
          {
            "cpes": [
              "cpe:2.3:a:gl-inet:x750:4.3.7:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "x750",
            "vendor": "gl-inet",
            "versions": [
              {
                "status": "affected",
                "version": "4.3.7"
              }
            ]
          },
          {
            "cpes": [
              "cpe:2.3:a:gl-inet:sft1200:4.3.7:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "sft1200",
            "vendor": "gl-inet",
            "versions": [
              {
                "status": "affected",
                "version": "4.3.7"
              }
            ]
          },
          {
            "cpes": [
              "cpe:2.3:a:gl-inet:xe300:4.3.7:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "xe300",
            "vendor": "gl-inet",
            "versions": [
              {
                "status": "affected",
                "version": "4.3.7"
              }
            ]
          },
          {
            "cpes": [
              "cpe:2.3:a:gl-inet:ar3000m:4.3.10:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "ar3000m",
            "vendor": "gl-inet",
            "versions": [
              {
                "status": "affected",
                "version": "4.3.10"
              }
            ]
          },
          {
            "cpes": [
              "cpe:2.3:a:gl-inet:ar3000m16:4.3.10:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "ar3000m16",
            "vendor": "gl-inet",
            "versions": [
              {
                "status": "affected",
                "version": "4.3.10"
              }
            ]
          },
          {
            "cpes": [
              "cpe:2.3:a:gl-inet:b1300:4.3.10:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "b1300",
            "vendor": "gl-inet",
            "versions": [
              {
                "status": "affected",
                "version": "4.3.10"
              }
            ]
          },
          {
            "cpes": [
              "cpe:2.3:a:gl-inet:mt300nv2:4.3.10:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "mt300nv2",
            "vendor": "gl-inet",
            "versions": [
              {
                "status": "affected",
                "version": "4.3.10"
              }
            ]
          },
          {
            "cpes": [
              "cpe:2.3:a:gl-inet:x300b:3.217:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "x300b",
            "vendor": "gl-inet",
            "versions": [
              {
                "status": "affected",
                "version": "3.217"
              }
            ]
          },
          {
            "cpes": [
              "cpe:2.3:a:gl-inet:s1300:3.216:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "s1300",
            "vendor": "gl-inet",
            "versions": [
              {
                "status": "affected",
                "version": "3.216"
              }
            ]
          },
          {
            "cpes": [
              "cpe:2.3:a:gl-inet:sf1200:3.216:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "sf1200",
            "vendor": "gl-inet",
            "versions": [
              {
                "status": "affected",
                "version": "3.216"
              }
            ]
          },
          {
            "cpes": [
              "cpe:2.3:a:gl-inet:mv1000:3.216:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "mv1000",
            "vendor": "gl-inet",
            "versions": [
              {
                "status": "affected",
                "version": "3.216"
              }
            ]
          },
          {
            "cpes": [
              "cpe:2.3:a:gl-inet:n300:3.216:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "n300",
            "vendor": "gl-inet",
            "versions": [
              {
                "status": "affected",
                "version": "3.216"
              }
            ]
          },
          {
            "cpes": [
              "cpe:2.3:a:gl-inet:b2200:3.216:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "b2200",
            "vendor": "gl-inet",
            "versions": [
              {
                "status": "affected",
                "version": "3.216"
              }
            ]
          },
          {
            "cpes": [
              "cpe:2.3:a:gl-i:x1200:3.203:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "x1200",
            "vendor": "gl-i",
            "versions": [
              {
                "status": "affected",
                "version": "3.203"
              }
            ]
          }
        ],
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "NONE",
              "baseScore": 7.5,
              "baseSeverity": "HIGH",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "NONE",
              "privilegesRequired": "NONE",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2024-27356",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-02-27T15:51:15.040940Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-200",
                "description": "CWE-200 Exposure of Sensitive Information to an Unauthorized Actor",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-03-24T15:44:54.024Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "An issue was discovered on certain GL-iNet devices. Attackers can download files such as logs via commands, potentially obtaining critical user information. This affects MT6000 4.5.5, XE3000 4.4.4, X3000 4.4.5, MT3000 4.5.0, MT2500 4.5.0, AXT1800 4.5.0, AX1800 4.5.0, A1300 4.5.0, S200 4.1.4-0300, X750 4.3.7, SFT1200 4.3.7, XE300 4.3.7, MT1300 4.3.10, AR750 4.3.10, AR750S 4.3.10, AR300M 4.3.10, AR300M16 4.3.10, B1300 4.3.10, MT300N-v2 4.3.10, X300B 3.217, S1300 3.216, SF1200 3.216, MV1000 3.216, N300 3.216, B2200 3.216, and X1200 3.203."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-02-27T00:17:16.406Z",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "url": "https://gl-inet.com"
        },
        {
          "url": "https://github.com/gl-inet/CVE-issues/blob/main/4.0.0/Download_file_vulnerability.md"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2024-27356",
    "datePublished": "2024-02-27T00:00:00.000Z",
    "dateReserved": "2024-02-25T00:00:00.000Z",
    "dateUpdated": "2025-03-24T15:44:54.024Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

BDU:2024-04298 (CVE-2024-27356)

CVE-2024-27356 (GCVE-0-2024-27356)

Tags

Sightings

Nomenclature

Related by attack behaviour