cbcvebase.
CVE-2024-45261
published 2024-10-24

CVE-2024-45261: An issue was discovered on certain GL-iNet devices, including MT6000, MT3000, MT2500, AXT1800, and AX1800 4.6.2. The SID generated for a specific user is not…

PriorityP345high8CVSS 3.1
AVAACLPRLUINSUCHIHAH
EPSS
0.48%
37.8th percentile
An issue was discovered on certain GL-iNet devices, including MT6000, MT3000, MT2500, AXT1800, and AX1800 4.6.2. The SID generated for a specific user is not tied to that user itself, which allows other users to potentially use it for authentication. Once an attacker bypasses the application's authentication procedures, they can generate a valid SID, escalate privileges, and gain full control.

Affected

21 ranges
VendorProductVersion rangeFixed in
gl-ineta1300_firmware——
gl-inetar300m16_firmware——
gl-inetar300m_firmware——
gl-inetar750_firmware——
gl-inetar750s_firmware——
gl-inetax1800_firmware>= 4.6.2 < 4.6.44.6.4
gl-inetaxt1800_firmware>= 4.6.2 < 4.6.44.6.4
gl-inetb1300_firmware——
gl-inetb3000_firmware——
gl-inete750_firmware——
gl-inetmt1300_firmware——
gl-inetmt2500_firmware>= 4.6.2 < 4.6.44.6.4
gl-inetmt3000_firmware——
gl-inetmt300n-v2_firmware——
gl-inetmt6000_firmware——
gl-inetsft1200_firmware——
gl-inetx3000_firmware——
gl-inetx300b_firmware——
gl-inetx750_firmware——
gl-inetxe3000_firmware——
gl-inetxe300_firmware——
Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.