PT-2024-22254 · Gl.Inet · Gl-Inet Ar300M+14

Published 2024-08-26 · Updated 2024-09-05 · CVE-2024-28077

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions GL-iNet MT6000 versions 4.3.10 through 4.5.6 GL-iNet XE3000 version 4.4.5 GL-iNet X3000 version 4.4.6 GL-iNet MT3000 version 4.5.0 GL-iNet MT2500 version 4.5.0 GL-iNet AXT1800 version 4.5.0 GL-iNet AX1800 version 4.5.0 GL-iNet A1300 version 4.5.0 GL-iNet S200 version 4.1.4-0300 GL-iNet X750 version 4.3.7 GL-iNet SFT1200 version 4.3.7 GL-iNet MT1300 version 4.3.10 GL-iNet AR750 version 4.3.10 GL-iNet AR750S version 4.3.10 GL-iNet AR300M version 4.3.10 GL-iNet AR300M16 version 4.3.10 GL-iNet B1300 version 4.3.10 GL-iNet MT300N-V2 version 4.3.10 GL-iNet XE300 version 4.3.16

Description A denial-of-service issue was discovered on certain GL-iNet devices. Some websites can detect devices exposed to the external network through DDNS, and consequently obtain the IP addresses and ports of devices that are exposed. By using special usernames and special characters (such as half parentheses or square brackets), one can call the login interface and cause the session-management program to crash, resulting in customers being unable to log into their devices.

Recommendations For GL-iNet MT6000 versions 4.3.10 through 4.5.6, update to version 4.5.8 to mitigate the risk. For GL-iNet XE3000 version 4.4.5, update to version 4.4.8 to mitigate the risk. For other affected versions, at the moment, there is no information about a newer version that contains a fix for this vulnerability. As a temporary workaround, consider restricting access to the login interface to minimize the risk of exploitation.

Exploit

Related Identifiers

CVE-2024-28077

Affected Products

Gl-Inet A1300

Gl-Inet Ar300M

Gl-Inet Ar300M16

Gl-Inet Ar750

Gl-Inet Ax1800

Gl-Inet Mt1300

Gl-Inet Mt2500

Gl-Inet Mt3000

Gl-Inet Mt300N-V2

Gl-Inet Mt6000

Gl-Inet S200

Gl-Inet Sft1200

Gl-Inet X3000

Gl-Inet X750

Gl-Inet Xe300

References · 9

• 🔥 https://github.com/gl-inet/CVE-issues/blob/main/4.0.0/Denial%20of%20service.md · Exploit
• https://osv.dev/vulnerability/CVE-2024-28077 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-28077 · Security Note
• https://gl-inet.com · Note
• https://twitter.com/transilienceai/status/1829198758053073171 · Twitter Post
• https://twitter.com/CVEnew/status/1828154750837444845 · Twitter Post
• https://twitter.com/transilienceai/status/1829585106555552059 · Twitter Post
• https://t.me/cvenotify/92266 · Telegram Post
• https://t.me/cvedetector/4203 · Telegram Post