CVE-2024-27356
Attackers can download files such as logs via commands, potentially obtaining critical user information.
Does this matter?
EPSS puts the probability of exploitation in the next 30 days at 23.9%, higher than 98% of all known CVEs. Patch or mitigate before the next change window.
Description
An issue was discovered on certain GL-iNet devices. Attackers can download files such as logs via commands, potentially obtaining critical user information. This affects MT6000 4.5.5, XE3000 4.4.4, X3000 4.4.5, MT3000 4.5.0, MT2500 4.5.0, AXT1800 4.5.0, AX1800 4.5.0, A1300 4.5.0, S200 4.1.4-0300, X750 4.3.7, SFT1200 4.3.7, XE300 4.3.7, MT1300 4.3.10, AR750 4.3.10, AR750S 4.3.10, AR300M 4.3.10, AR300M16 4.3.10, B1300 4.3.10, MT300N-v2 4.3.10, X300B 3.217, S1300 3.216, SF1200 3.216, MV1000 3.216, N300 3.216, B2200 3.216, and X1200 3.203.
- CVSS 3.1
- 7.5 HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
- EPSS
- 23.91% probability · 98th percentile
- Public exploits
- 1 in Exploit-DB · first 2 April 2024
- CISA KEV
- Not listed
- Weakness
- CWE-200
- Affected
- gl-inet/mt6000 firmware · gl-inet/xe3000 firmware · gl-inet/x3000 firmware · gl-inet/mt3000 firmware · gl-inet/mt2500 firmware · gl-inet/axt1800 firmware · gl-inet/ax1800 firmware · gl-inet/a1300 firmware · gl-inet/s200 firmware · gl-inet/x750 firmware · gl-inet/sft1200 firmware · gl-inet/xe300 firmware · gl-inet/mt1300 firmware · gl-inet/ar750 firmware · gl-inet/ar750s firmware · gl-inet/ar300m firmware · gl-inet/ar300m16 firmware · gl-inet/b1300 firmware · gl-inet/mt300n-v2 firmware · gl-inet/x300b firmware · +6 more
- Source
- cve@mitre.org
EPSS 23.9% since 27 October 2026; no change recorded yet. The dashed line is the ten per cent mark our analysts treat as “patch before the next change window”. Points are recorded when the score first appears and whenever it moves by a percentage point or more.
Public exploits (1)
Entries in Exploit-DB that cite this CVE. Links go to the Exploit-DB page and to the file in the public repository; nothing is hosted here. A verified tick means the Exploit-DB team confirmed the exploit works against the stated version.
References
- https://github.com/gl-inet/CVE-issues/blob/main/4.0.0/Download_file_vulnerability.mdThird Party Advisory
- https://gl-inet.comProduct
- https://github.com/gl-inet/CVE-issues/blob/main/4.0.0/Download_file_vulnerability.mdThird Party Advisory
- https://gl-inet.comProduct
Source: NVD record, EPSS from FIRST.org, KEV from CISA, exploits from Exploit-DB. Refreshed daily. Download this record as JSON.