CVE-2024-27356
Attackers can download files such as logs via commands, potentially obtaining critical user information.
Does this matter?
EPSS puts the probability of exploitation in the next 30 days at 23.9%, higher than 98% of all known CVEs. Patch or mitigate before the next change window.
Description
An issue was discovered on certain GL-iNet devices. Attackers can download files such as logs via commands, potentially obtaining critical user information. This affects MT6000 4.5.5, XE3000 4.4.4, X3000 4.4.5, MT3000 4.5.0, MT2500 4.5.0, AXT1800 4.5.0, AX1800 4.5.0, A1300 4.5.0, S200 4.1.4-0300, X750 4.3.7, SFT1200 4.3.7, XE300 4.3.7, MT1300 4.3.10, AR750 4.3.10, AR750S 4.3.10, AR300M 4.3.10, AR300M16 4.3.10, B1300 4.3.10, MT300N-v2 4.3.10, X300B 3.217, S1300 3.216, SF1200 3.216, MV1000 3.216, N300 3.216, B2200 3.216, and X1200 3.203.
- CVSS 3.1
- 7.5 HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
- EPSS
- 23.91% probability · 98th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-200
- Affected
- gl-inet/mt6000 firmware · gl-inet/xe3000 firmware · gl-inet/x3000 firmware · gl-inet/mt3000 firmware · gl-inet/mt2500 firmware · gl-inet/axt1800 firmware · gl-inet/ax1800 firmware · gl-inet/a1300 firmware · gl-inet/s200 firmware · gl-inet/x750 firmware · gl-inet/sft1200 firmware · gl-inet/xe300 firmware · gl-inet/mt1300 firmware · gl-inet/ar750 firmware · gl-inet/ar750s firmware · gl-inet/ar300m firmware · gl-inet/ar300m16 firmware · gl-inet/b1300 firmware · gl-inet/mt300n-v2 firmware · gl-inet/x300b firmware · +6 more
- Source
- cve@mitre.org
References
- https://github.com/gl-inet/CVE-issues/blob/main/4.0.0/Download_file_vulnerability.mdThird Party Advisory
- https://gl-inet.comProduct
- https://github.com/gl-inet/CVE-issues/blob/main/4.0.0/Download_file_vulnerability.mdThird Party Advisory
- https://gl-inet.comProduct
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.