PT-2025-17954 · Gl.Inet · Gl-Be3600 Slate 7+22

Pan.Li · Published 2025-04-26 · Updated 2025-05-14 · CVE-2025-2811

Positive Technologies (AI Summary)

CVSS v2.0

5.5

Medium

Base vector

AV:A/AC:L/Au:S/C:N/I:N/A:C

Name of the Vulnerable Software and Affected Versions GL.iNet GL-A1300 Slate Plus version 4.x GL.iNet GL-AR300M16 Shadow version 4.x GL.iNet GL-AR300M Shadow version 4.x GL.iNet GL-AR750 Creta version 4.x GL.iNet GL-AR750S-EXT Slate version 4.x GL.iNet GL-AX1800 Flint version 4.x GL.iNet GL-AXT1800 Slate AX version 4.x GL.iNet GL-B1300 Convexa-B version 4.x GL.iNet GL-B3000 Marble version 4.x GL.iNet GL-BE3600 Slate 7 version 4.x GL.iNet GL-E750 version 4.x GL.iNet GL-E750V2 Mudi version 4.x GL.iNet GL-MT300N-V2 Mango version 4.x GL.iNet GL-MT1300 Beryl version 4.x GL.iNet GL-MT2500 Brume 2 version 4.x GL.iNet GL-MT3000 Beryl AX version 4.x GL.iNet GL-MT6000 Flint 2 version 4.x GL.iNet GL-SFT1200 Opal version 4.x GL.iNet GL-X300B Collie version 4.x GL.iNet GL-X750 Spitz version 4.x GL.iNet GL-X3000 Spitz AX version 4.x GL.iNet GL-XE300 Puli version 4.x GL.iNet GL-XE3000 Puli AX version 4.x

Description A vulnerability was found in the component API of the affected GL.iNet devices. The manipulation leads to inefficient regular expression complexity. It is recommended to upgrade the affected component.

Recommendations Upgrade the affected component to a newer version for each of the affected devices: GL.iNet GL-A1300 Slate Plus GL.iNet GL-AR300M16 Shadow GL.iNet GL-AR300M Shadow GL.iNet GL-AR750 Creta GL.iNet GL-AR750S-EXT Slate GL.iNet GL-AX1800 Flint GL.iNet GL-AXT1800 Slate AX GL.iNet GL-B1300 Convexa-B GL.iNet GL-B3000 Marble GL.iNet GL-BE3600 Slate 7 GL.iNet GL-E750 GL.iNet GL-E750V2 Mudi GL.iNet GL-MT300N-V2 Mango GL.iNet GL-MT1300 Beryl GL.iNet GL-MT2500 Brume 2 GL.iNet GL-MT3000 Beryl AX GL.iNet GL-MT6000 Flint 2 GL.iNet GL-SFT1200 Opal GL.iNet GL-X300B Collie GL.iNet GL-X750 Spitz GL.iNet GL-X3000 Spitz AX GL.iNet GL-XE300 Puli GL.iNet GL-XE3000 Puli AX

Exploit

Fix

Resource Exhaustion

DoS

Weakness Enumeration

CWE-400

CWE-1333

Related Identifiers

CVE-2025-2811

Affected Products

Gl-A1300 Slate Plus

Gl-Ar300M Shadow

Gl-Ar300M16 Shadow

Gl-Ar750 Creta

Gl-Ar750S-Ext Slate

Gl-Ax1800 Flint

Gl-Axt1800 Slate Ax

Gl-B1300 Convexa-B

Gl-B3000 Marble

Gl-Be3600 Slate 7

Gl-E750

Gl-E750V2 Mudi

Gl-Mt1300 Beryl

Gl-Mt2500 Brume 2

Gl-Mt3000 Beryl Ax

Gl-Mt300N-V2 Mango

Gl-Mt6000 Flint 2

Gl-Sft1200 Opal

Gl-X3000 Spitz Ax

Gl-X300B Collie

Gl-X750 Spitz

Gl-Xe300 Puli

Gl-Xe3000 Puli Ax

References · 12

• 🔥 https://github.com/gl-inet/CVE-issues/blob/main/4.0.0/Calling%20a%20special%20API%20that%20doesn\'t%20require%20login%20and%20passing%20in%20a%20special%20character%20parameter%20results%20in%20100%25%20CPU%20usage.md · Exploit
• https://gl-inet.com/security-updates/security-advisories-vulnerabilities-and-cves-apr-24-2025 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2025-2811 · Security Note
• https://vuldb.com/?ctiid.306286 · Note
• https://twitter.com/syedaquib77/status/1920928899699028395 · Twitter Post
• https://vuldb.com/?submit.524459 · Note
• https://vuldb.com/?id.306286 · Note
• https://t.me/cvetracker/22415 · Telegram Post
• https://twitter.com/syedaquib77/status/1922476498059186598 · Twitter Post
• https://twitter.com/CVEnew/status/1916027962350063744 · Twitter Post
• https://t.me/cvedetector/23793 · Telegram Post
• https://t.me/cvenotify/119906 · Telegram Post