PT-2024-28400 · Gl.Inet · B1300+19

Published

2024-08-06

·

Updated

2024-08-15

·

CVE-2024-39228

CVSS v3.1

9.8

Critical

VectorAV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Name of the Vulnerable Software and Affected Versions GL-iNet products AR750/AR750S/AR300M/AR300M16/MT300N-V2/B1300/MT1300/SFT1200/X750 version 4.3.11 GL-iNet products MT3000/MT2500/AXT1800/AX1800/A1300/X300B version 4.5.16 GL-iNet products XE300 version 4.3.16 GL-iNet products E750 version 4.3.12 GL-iNet products AP1300/S1300 version 4.3.13 GL-iNet products XE3000/X3000 version 4.4
Description A shell injection issue was discovered in the interface via check ovpn client config and check config.
Recommendations For version 4.3.11, consider disabling the check ovpn client config and check config interfaces until a patch is available. For version 4.5.16, consider disabling the check ovpn client config and check config interfaces until a patch is available. For version 4.3.16, consider disabling the check ovpn client config and check config interfaces until a patch is available. For version 4.3.12, consider disabling the check ovpn client config and check config interfaces until a patch is available. For version 4.3.13, consider disabling the check ovpn client config and check config interfaces until a patch is available. For version 4.4, consider disabling the check ovpn client config and check config interfaces until a patch is available.

Exploit

Fix

OS Command Injection

Weakness Enumeration

CWE-78

Related Identifiers

CVE-2024-39228

Affected Products

A1300
Ap1300
Ar300M
Ar300M16
Ar750
Ar750S
Axt1800
B1300
E750
Mt1300
Mt2500
Mt3000
Mt300N-V2
S1300
Sft1200
X3000
X300B
X750
Xe300
Xe3000