CVEvulnerability

CVE-2024-45259

6.5 MEDIUM Published 2024-10-24 Modified 2026-06-17 Official page ↗
Status
Analyzed
Published
2024-10-24
Last modified
2026-06-17
Assigner
[email protected]
CVSS 3.1 (134c704f-9b21-4f2e-91b3-4a467353bcc0)
6.5 MEDIUM — CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Weaknesses
CWE-326

Description

An issue was discovered on certain GL-iNet devices, including MT6000, MT3000, MT2500, AXT1800, and AX1800 4.6.2. By intercepting an HTTP request and changing the filename property in the download interface, any file on the device can be deleted.

Affected configurations

• gl-inet mt3000 firmware 4.6.2 • gl-inet mt2500 firmware (>= 4.6.2 < 4.6.4) • gl-inet axt1800 firmware (>= 4.6.2 < 4.6.4) • gl-inet ax1800 firmware (>= 4.6.2 < 4.6.4) • gl-inet b3000 firmware 4.5.18 • gl-inet a1300 firmware 4.5.17 • gl-inet x300b firmware 4.5.17 • gl-inet x3000 firmware 4.4.9 • gl-inet xe3000 firmware 4.4.9 • gl-inet x750 firmware 4.3.18 • gl-inet sft1200 firmware 4.3.18 • gl-inet mt1300 firmware 4.3.18 • gl-inet e750 firmware 4.3.17 • gl-inet xe300 firmware 4.3.17 • gl-inet ar750 firmware 4.3.17 • gl-inet ar750s firmware 4.3.17 • gl-inet ar300m firmware 4.3.17 • gl-inet ar300m16 firmware 4.3.17 • gl-inet mt300n-v2 firmware 4.3.17 • gl-inet b1300 firmware 4.3.17 • gl-inet mt6000 firmware 4.6.2

Related

Weakness · CWE (1)

  • CWE-326 Inadequate Encryption Strength weakness

References