PT-2024-28399 · Gl.Inet · B1300+19

Published

2024-08-06

·

Updated

2024-08-15

·

CVE-2024-39227

CVSS v3.1

9.8

Critical

VectorAV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Name of the Vulnerable Software and Affected Versions GL-iNet products AR750/AR750S/AR300M/AR300M16/MT300N-V2/B1300/MT1300/SFT1200/X750 version 4.3.11 GL-iNet products MT3000/MT2500/AXT1800/AX1800/A1300/X300B version 4.5.16 GL-iNet products XE300 version 4.3.16 GL-iNet products E750 version 4.3.12 GL-iNet products AP1300/S1300 version 4.3.13 GL-iNet products XE3000/X3000 version 4.4
Description The issue concerns insecure permissions in the endpoint "/cgi-bin/glc" that allows unauthenticated attackers to execute arbitrary code or possibly perform a directory traversal via crafted JSON data. Additionally, a shell injection vulnerability was discovered via the interface check ovpn client config.
Recommendations For version 4.3.11, consider disabling access to the /cgi-bin/glc endpoint until a patch is available. For version 4.5.16, restrict the use of the check ovpn client config interface to minimize the risk of exploitation. For version 4.3.16, avoid using the vulnerable endpoint /cgi-bin/glc in production environments. For version 4.3.12, limit access to the check ovpn client config interface to trusted users only. For version 4.3.13, disable the /cgi-bin/glc endpoint as a temporary workaround. For version 4.4, restrict access to the vulnerable interface check ovpn client config to prevent potential attacks.

Exploit

Fix

Special Elements Injection

Found an issue in the description? Have something to add? Feel free to write us 👾
dbugs@ptsecurity.com

Weakness Enumeration

CWE-74CWE-75

Related Identifiers

CVE-2024-39227

Affected Products

A1300
Ap1300
Ar300M
Ar300M16
Ar750
Ar750S
Axt1800
B1300
E750
Mt1300
Mt2500
Mt3000
Mt300N-V2
S1300
Sft1200
X3000
X300B
X750
Xe300
Xe3000