PT-2024-28401 · Gl.Inet · N300+23

Published 2024-08-06 · Updated 2024-08-15 · CVE-2024-39229

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions GL-iNet products AR750/AR750S/AR300M/AR300M16/MT300N-V2/B1300/MT1300/SFT1200/X750 version 4.3.11 GL-iNet products MT3000/MT2500/AXT1800/AX1800/A1300/X300B version 4.5.16 GL-iNet products XE300 version 4.3.16 GL-iNet products E750 version 4.3.12 GL-iNet products AP1300/S1300 version 4.3.13 GL-iNet products XE3000/X3000 version 4 GL-iNet products B2200/MV1000/MV1000W/USB150/N300/SF1200 version 3.216

Description The issue allows attackers to intercept communications via a man-in-the-middle attack when DDNS clients are reporting data to the server.

Recommendations For version 4.3.11 of GL-iNet products AR750/AR750S/AR300M/AR300M16/MT300N-V2/B1300/MT1300/SFT1200/X750, consider disabling the DDNS client functionality until a patch is available. For version 4.5.16 of GL-iNet products MT3000/MT2500/AXT1800/AX1800/A1300/X300B, consider disabling the DDNS client functionality until a patch is available. For version 4.3.16 of GL-iNet products XE300, consider disabling the DDNS client functionality until a patch is available. For version 4.3.12 of GL-iNet products E750, consider disabling the DDNS client functionality until a patch is available. For version 4.3.13 of GL-iNet products AP1300/S1300, consider disabling the DDNS client functionality until a patch is available. For version 4 of GL-iNet products XE3000/X3000, consider disabling the DDNS client functionality until a patch is available. For version 3.216 of GL-iNet products B2200/MV1000/MV1000W/USB150/N300/SF1200, consider disabling the DDNS client functionality until a patch is available.

Exploit

Fix

Weakness Enumeration

CWE-924

Related Identifiers

CVE-2024-39229

Affected Products

A1300

Ap1300

Ar300M

Ar300M16

Ar750

Ar750S

Axt1800

B1300

B2200

E750

Mt1300

Mt2500

Mt3000

Mt300N-V2

Mv1000

N300

S1300

Sft1200

Usb150

X3000

X300B

X750

Xe300

Xe3000

References · 6

• 🔥 https://github.com/gl-inet/CVE-issues/blob/main/4.0.0/DDNS%20data%20is%20not%20encrypted.md · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2024-39229 · Security Note
• https://osv.dev/vulnerability/CVE-2024-39229 · Vendor Advisory
• https://t.me/cvenotify/90152 · Telegram Post
• https://t.me/cvedetector/2620 · Telegram Post
• https://t.me/cvenotify/89482 · Telegram Post