PT-2024-31520 · Gl.Inet · Gl-Inet Mt2500+3

Published 2024-10-24 · Updated 2024-10-28 · CVE-2024-45263

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions GL-iNet MT6000 version 4.6.2 GL-iNet MT3000 version 4.6.2 GL-iNet MT2500 version 4.6.2 GL-iNet AXT1800 version 4.6.2 GL-iNet AX1800 version 4.6.2

Description An issue was discovered on certain GL-iNet devices. The upload interface allows the uploading of arbitrary files to the device. Once the device executes the files, it can lead to information leakage, enabling complete control.

Recommendations For GL-iNet MT6000 version 4.6.2, restrict access to the upload interface to minimize the risk of exploitation. For GL-iNet MT3000 version 4.6.2, consider disabling the file execution feature until a patch is available. For GL-iNet MT2500 version 4.6.2, avoid using the upload interface until the issue is resolved. For GL-iNet AXT1800 version 4.6.2, limit the types of files that can be uploaded to prevent malicious file execution. For GL-iNet AX1800 version 4.6.2, implement additional security measures to prevent information leakage and unauthorized control. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Unrestricted File Upload

Weakness Enumeration

CWE-434

Related Identifiers

CVE-2024-45263

Affected Products

Gl-Inet Ax1800

Gl-Inet Mt2500

Gl-Inet Mt3000

Gl-Inet Mt6000

References · 5

• 🔥 https://github.com/gl-inet/CVE-issues/blob/main/4.0.0/Arbitrary%20File%20Upload%20to%20ovpn_upload%20via%20Upload%20Interface.md · Exploit
• https://osv.dev/vulnerability/CVE-2024-45263 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-45263 · Security Note
• https://t.me/cvedetector/8859 · Telegram Post
• https://t.me/cvenotify/99443 · Telegram Post