cbcvebase.
CVE-2024-28077
published 2024-08-26

CVE-2024-28077: A denial-of-service issue was discovered on certain GL-iNet devices. Some websites can detect devices exposed to the external network through DDNS, and…

PriorityP339high7.5CVSS 3.1
AVNACLPRNUINSUCNINAH
EPSS
0.43%
34.4th percentile
A denial-of-service issue was discovered on certain GL-iNet devices. Some websites can detect devices exposed to the external network through DDNS, and consequently obtain the IP addresses and ports of devices that are exposed. By using special usernames and special characters (such as half parentheses or square brackets), one can call the login interface and cause the session-management program to crash, resulting in customers being unable to log into their devices. This affects MT6000 4.5.6, XE3000 4.4.5, X3000 4.4.6, MT3000 4.5.0, MT2500 4.5.0, AXT1800 4.5.0, AX1800 4.5.0, A1300 4.5.0, S200 4.1.4-0300, X750 4.3.7, SFT1200 4.3.7, MT1300 4.3.10, AR750 4.3.10, AR750S 4.3.10, AR300M 4.3.10, AR300M16 4.3.10, B1300 4.3.10, MT300N-V2 4.3.10, and XE300 4.3.16.

Affected

18 ranges
VendorProductVersion rangeFixed in
gl-ineta1300_firmware——
gl-inetar300m16_firmware——
gl-inetar300m_firmware——
gl-inetar750_firmware——
gl-inetar750s_firmware——
gl-inetax1800_firmware——
gl-inetaxt1800_firmware——
gl-inetb1300_firmware——
gl-inetmt1300_firmware——
gl-inetmt2500_firmware——
gl-inetmt3000_firmware——
gl-inetmt300n-v2_firmware——
gl-inetmt6000_firmware——
gl-inetsft1200_firmware——
gl-inetx3000_firmware——
gl-inetx750_firmware——
gl-inetxe3000_firmware——
gl-inetxe300_firmware——
Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.