FKIE_CVE-2024-45263

Vulnerability from fkie_nvd - Published: 2024-10-24 21:15 - Updated: 2025-09-29 15:02
Severity ?
8.8 (High) - CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Summary
An issue was discovered on certain GL-iNet devices, including MT6000, MT3000, MT2500, AXT1800, and AX1800 4.6.2. The upload interface allows the uploading of arbitrary files to the device. Once the device executes the files, it can lead to information leakage, enabling complete control.
References
cve@mitre.orghttps://github.com/gl-inet/CVE-issues/blob/main/4.0.0/Arbitrary%20File%20Upload%20to%20ovpn_upload%20via%20Upload%20Interface.mdIssue Tracking, Third Party Advisory
Impacted products
Vendor Product Version
gl-inet mt6000_firmware 4.6.2
gl-inet mt6000 -
gl-inet mt3000_firmware *
gl-inet gl-mt3000 -
gl-inet mt2500_firmware *
gl-inet mt2500 -
gl-inet axt1800_firmware *
gl-inet axt1800 -
gl-inet ax1800_firmware *
gl-inet ax1800 -
gl-inet b3000_firmware 4.5.18
gl-inet b3000 -
gl-inet a1300_firmware 4.5.17
gl-inet a1300 -
gl-inet x300b_firmware 4.5.17
gl-inet x300b -
gl-inet x3000_firmware 4.4.9
gl-inet x3000 -
gl-inet xe3000_firmware 4.4.9
gl-inet xe3000 -
gl-inet x750_firmware 4.3.18
gl-inet x750 -
gl-inet sft1200_firmware 4.3.18
gl-inet sft1200 -
gl-inet mt1300_firmware 4.3.18
gl-inet mt1300 -
gl-inet e750_firmware 4.3.17
gl-inet e750 -
gl-inet xe300_firmware 4.3.17
gl-inet xe300 -
gl-inet ar750_firmware 4.3.17
gl-inet ar750 -
gl-inet ar750s_firmware 4.3.17
gl-inet ar750s -
gl-inet ar300m_firmware 4.3.17
gl-inet ar300m -
gl-inet ar300m16_firmware 4.3.17
gl-inet ar300m16 -
gl-inet b1300_firmware 4.3.17
gl-inet b1300 -
gl-inet mt300n-v2_firmware 4.3.17
gl-inet mt300n-v2 -
To clipboard 

{
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:gl-inet:mt6000_firmware:4.6.2:*:*:*:*:*:*:*",
              "matchCriteriaId": "E548391D-3E1D-4A8C-8F7C-8740EAD5CB9E",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        },
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:h:gl-inet:mt6000:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "CCDE99A6-DA15-4E4B-8C60-CCB9D580BD82",
              "vulnerable": false
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ],
      "operator": "AND"
    },
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:gl-inet:mt3000_firmware:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "02F67B09-8A97-4235-BBFC-24B72C2F8B1F",
              "versionEndExcluding": "4.6.4",
              "versionStartIncluding": "4.6.2",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        },
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:h:gl-inet:gl-mt3000:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "4D832083-488B-40F2-8D7A-66E917DF67F9",
              "vulnerable": false
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ],
      "operator": "AND"
    },
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:gl-inet:mt2500_firmware:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "A8537E0A-8726-4355-AA99-06445A43D4D5",
              "versionEndExcluding": "4.6.4",
              "versionStartIncluding": "4.6.2",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        },
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:h:gl-inet:mt2500:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "3ADF5BF3-0F52-4947-8BC2-3505EDEEDF28",
              "vulnerable": false
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ],
      "operator": "AND"
    },
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:gl-inet:axt1800_firmware:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "4607385A-CD71-4809-A143-EE2E9DE0F69A",
              "versionEndExcluding": "4.6.4",
              "versionStartIncluding": "4.6.2",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        },
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:h:gl-inet:axt1800:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "FF453954-BC32-4577-8CE4-066812193495",
              "vulnerable": false
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ],
      "operator": "AND"
    },
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:gl-inet:ax1800_firmware:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "81DEAE12-BC9B-40C5-9D51-25A478670A73",
              "versionEndExcluding": "4.6.4",
              "versionStartIncluding": "4.6.2",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        },
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:h:gl-inet:ax1800:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "BCB312FD-370C-4DF9-961F-F0C4920AA368",
              "vulnerable": false
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ],
      "operator": "AND"
    },
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:gl-inet:b3000_firmware:4.5.18:*:*:*:*:*:*:*",
              "matchCriteriaId": "38EDCC99-D442-4FC5-B9DC-5CF38B6EE1FA",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        },
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:h:gl-inet:b3000:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "4EA9AD80-5B5E-4736-9146-5F58212D2988",
              "vulnerable": false
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ],
      "operator": "AND"
    },
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:gl-inet:a1300_firmware:4.5.17:*:*:*:*:*:*:*",
              "matchCriteriaId": "B48595C6-E07A-4E74-B695-D6D679B6A3ED",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        },
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:h:gl-inet:a1300:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "D6DBF472-E98E-4E00-B6A0-6D8FA1678AEA",
              "vulnerable": false
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ],
      "operator": "AND"
    },
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:gl-inet:x300b_firmware:4.5.17:*:*:*:*:*:*:*",
              "matchCriteriaId": "B3FAB581-A524-4521-A293-84DD106543C5",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        },
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:h:gl-inet:x300b:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "B2AA4BAC-C6D1-42C0-94E9-5B05AC24A235",
              "vulnerable": false
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ],
      "operator": "AND"
    },
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:gl-inet:x3000_firmware:4.4.9:*:*:*:*:*:*:*",
              "matchCriteriaId": "F075420C-AD43-475E-8398-114AAA4002EE",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        },
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:h:gl-inet:x3000:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "9479FFAA-9C87-4530-884D-B96055A3D41C",
              "vulnerable": false
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ],
      "operator": "AND"
    },
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:gl-inet:xe3000_firmware:4.4.9:*:*:*:*:*:*:*",
              "matchCriteriaId": "998569E6-B905-4195-B333-FFFB255EA1FC",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        },
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:h:gl-inet:xe3000:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "265EDD5D-B879-4E8A-A6DE-400BC6273A41",
              "vulnerable": false
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ],
      "operator": "AND"
    },
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:gl-inet:x750_firmware:4.3.18:*:*:*:*:*:*:*",
              "matchCriteriaId": "A48B5B4A-D6E1-478C-B983-FFD1AC9AA4F0",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        },
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:h:gl-inet:x750:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "3D1EDFF0-F67C-4801-815C-309940BD7338",
              "vulnerable": false
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ],
      "operator": "AND"
    },
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:gl-inet:sft1200_firmware:4.3.18:*:*:*:*:*:*:*",
              "matchCriteriaId": "334563F9-7746-48A4-9E37-0AF55F44DC6A",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        },
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:h:gl-inet:sft1200:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "E656351D-E06E-435F-B1E5-34B89FD8B54B",
              "vulnerable": false
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ],
      "operator": "AND"
    },
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:gl-inet:mt1300_firmware:4.3.18:*:*:*:*:*:*:*",
              "matchCriteriaId": "744B2B01-1F28-429F-A898-056470D0DFE1",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        },
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:h:gl-inet:mt1300:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "5CECA41F-E807-4234-8C41-477DE132210E",
              "vulnerable": false
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ],
      "operator": "AND"
    },
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:gl-inet:e750_firmware:4.3.17:*:*:*:*:*:*:*",
              "matchCriteriaId": "64F877D5-D386-4390-8B32-E7110C6E7463",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        },
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:h:gl-inet:e750:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "2D3590B0-7F4B-49C2-BE77-57AD27A91018",
              "vulnerable": false
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ],
      "operator": "AND"
    },
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:gl-inet:xe300_firmware:4.3.17:*:*:*:*:*:*:*",
              "matchCriteriaId": "8CE85DAF-B5ED-4D5B-A009-BC7FA2AD0F92",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        },
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:h:gl-inet:xe300:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "57D82B62-F057-42A4-8530-86145AE91AC2",
              "vulnerable": false
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ],
      "operator": "AND"
    },
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:gl-inet:ar750_firmware:4.3.17:*:*:*:*:*:*:*",
              "matchCriteriaId": "E5BC42BD-03FA-45C1-A7D9-BA9DBE68B7A4",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        },
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:h:gl-inet:ar750:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "749A6936-392E-430C-ABD3-33D4C5B3D178",
              "vulnerable": false
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ],
      "operator": "AND"
    },
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:gl-inet:ar750s_firmware:4.3.17:*:*:*:*:*:*:*",
              "matchCriteriaId": "1406DB81-E531-4648-B427-AB98793BC76A",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        },
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:h:gl-inet:ar750s:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "F18E5F1D-55CD-4F6A-A349-90DD27B29955",
              "vulnerable": false
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ],
      "operator": "AND"
    },
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:gl-inet:ar300m_firmware:4.3.17:*:*:*:*:*:*:*",
              "matchCriteriaId": "EB18BA54-1E3A-42DE-A4BD-07A96CE04663",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        },
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:h:gl-inet:ar300m:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "F040AC86-5D7A-4E57-B272-A425DDDE1698",
              "vulnerable": false
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ],
      "operator": "AND"
    },
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:gl-inet:ar300m16_firmware:4.3.17:*:*:*:*:*:*:*",
              "matchCriteriaId": "C6BD86A8-D5BA-41D8-BA9F-7228DE2C86F5",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        },
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:h:gl-inet:ar300m16:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "FA3E349B-C40F-4DE6-B977-CF677B2F9814",
              "vulnerable": false
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ],
      "operator": "AND"
    },
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:gl-inet:b1300_firmware:4.3.17:*:*:*:*:*:*:*",
              "matchCriteriaId": "425AB7BB-4BFC-463F-A0B8-9B1CC7A47FAD",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        },
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:h:gl-inet:b1300:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "A47EFE3F-D217-469E-BEE6-5D78037C71C3",
              "vulnerable": false
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ],
      "operator": "AND"
    },
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:gl-inet:mt300n-v2_firmware:4.3.17:*:*:*:*:*:*:*",
              "matchCriteriaId": "32494D06-2D09-4A26-B9AF-69F0682638D9",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        },
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:h:gl-inet:mt300n-v2:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "797DD304-0AF8-4E2C-8F72-ADF31B8AD6F4",
              "vulnerable": false
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ],
      "operator": "AND"
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "An issue was discovered on certain GL-iNet devices, including MT6000, MT3000, MT2500, AXT1800, and AX1800 4.6.2. The upload interface allows the uploading of arbitrary files to the device. Once the device executes the files, it can lead to information leakage, enabling complete control."
    },
    {
      "lang": "es",
      "value": "Se descubri\u00f3 un problema en ciertos dispositivos GL-iNet, incluidos MT6000, MT3000, MT2500, AXT1800 y AX1800 4.6.2. La interfaz de carga permite cargar archivos arbitrarios al dispositivo. Una vez que el dispositivo ejecuta los archivos, puede provocar una fuga de informaci\u00f3n, lo que permite un control total."
    }
  ],
  "id": "CVE-2024-45263",
  "lastModified": "2025-09-29T15:02:17.183",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "ADJACENT_NETWORK",
          "availabilityImpact": "HIGH",
          "baseScore": 8.8,
          "baseSeverity": "HIGH",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
          "version": "3.1"
        },
        "exploitabilityScore": 2.8,
        "impactScore": 5.9,
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "type": "Secondary"
      }
    ]
  },
  "published": "2024-10-24T21:15:12.217",
  "references": [
    {
      "source": "cve@mitre.org",
      "tags": [
        "Issue Tracking",
        "Third Party Advisory"
      ],
      "url": "https://github.com/gl-inet/CVE-issues/blob/main/4.0.0/Arbitrary%20File%20Upload%20to%20ovpn_upload%20via%20Upload%20Interface.md"
    }
  ],
  "sourceIdentifier": "cve@mitre.org",
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-434"
        }
      ],
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "type": "Secondary"
    }
  ]
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Detection rules are retrieved from Rulezet.