PT-2024-28398 · Gl.Inet · B1300+19

Published 2024-08-06 · Updated 2024-11-12 · CVE-2024-39226

Positive Technologies (AI Summary)

CVSS v2.0

10

Critical

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions GL-iNet products AR750/AR750S/AR300M/AR300M16/MT300N-V2/B1300/MT1300/SFT1200/X750 version 4.3.11 GL-iNet products MT3000/MT2500/AXT1800/AX1800/A1300/X300B version 4.5.16 GL-iNet products XE300 version 4.3.16 GL-iNet products E750 version 4.3.12 GL-iNet products AP1300/S1300 version 4.3.13 GL-iNet products XE3000/X3000 version 4.4

Description The issue allows manipulation of routers by passing malicious shell commands through the s2s API.

Recommendations For version 4.3.11, consider disabling access to the s2s API until a patch is available. For version 4.5.16, restrict the use of the s2s API to minimize the risk of exploitation. For version 4.3.16, avoid using the s2s API in production environments until the issue is resolved. For version 4.3.12, limit access to the s2s API to trusted sources. For version 4.3.13, consider implementing additional security measures to prevent malicious shell command execution. For version 4.4, restrict access to the s2s API to prevent potential exploitation.

Exploit

Fix

Path traversal

Command Injection

Weakness Enumeration

CWE-22

CWE-77

Related Identifiers

BDU:2025-14629

CVE-2024-39226

Affected Products

A1300

Ap1300

Ar300M

Ar300M16

Ar750

Ar750S

Axt1800

B1300

E750

Mt1300

Mt2500

Mt3000

Mt300N-V2

S1300

Sft1200

X3000

X300B

X750

Xe300

Xe3000

References · 5

• 🔥 https://github.com/gl-inet/CVE-issues/blob/main/4.0.0/s2s%20interface%20shell%20injection.md · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2024-39226 · Security Note
• https://bdu.fstec.ru/vul/2025-14629 · Security Note
• https://osv.dev/vulnerability/CVE-2024-39226 · Vendor Advisory
• https://t.me/cvenotify/101414 · Telegram Post