cbcvebase.
CVE-2024-45262
published 2024-10-24

CVE-2024-45262: An issue was discovered on certain GL-iNet devices, including MT6000, MT3000, MT2500, AXT1800, and AX1800 4.6.2. The params parameter in the call method of the…

PriorityP350high8.8CVSS 3.1
AVAACLPRNUINSUCHIHAH
EPSS
0.65%
46.4th percentile
An issue was discovered on certain GL-iNet devices, including MT6000, MT3000, MT2500, AXT1800, and AX1800 4.6.2. The params parameter in the call method of the /rpc endpoint is vulnerable to arbitrary directory traversal, which enables attackers to execute scripts under any path.

Affected

21 ranges
VendorProductVersion rangeFixed in
gl-ineta1300_firmware——
gl-inetar300m16_firmware——
gl-inetar300m_firmware——
gl-inetar750_firmware——
gl-inetar750s_firmware——
gl-inetax1800_firmware>= 4.6.2 < 4.6.44.6.4
gl-inetaxt1800_firmware>= 4.6.2 < 4.6.44.6.4
gl-inetb1300_firmware——
gl-inetb3000_firmware——
gl-inete750_firmware——
gl-inetmt1300_firmware——
gl-inetmt2500_firmware>= 4.6.2 < 4.6.44.6.4
gl-inetmt3000_firmware——
gl-inetmt300n-v2_firmware——
gl-inetmt6000_firmware——
gl-inetsft1200_firmware——
gl-inetx3000_firmware——
gl-inetx300b_firmware——
gl-inetx750_firmware——
gl-inetxe3000_firmware——
gl-inetxe300_firmware——
Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.