{"id":"CVE-2024-27356","url":"https://www.cyber-defence.io/tools/cve/CVE-2024-27356","generatedAt":"2026-10-28T05:02:18.575Z","title":"Attackers can download files such as logs via commands, potentially obtaining critical user information.","description":"An issue was discovered on certain GL-iNet devices. Attackers can download files such as logs via commands, potentially obtaining critical user information. This affects MT6000 4.5.5, XE3000 4.4.4, X3000 4.4.5, MT3000 4.5.0, MT2500 4.5.0, AXT1800 4.5.0, AX1800 4.5.0, A1300 4.5.0, S200 4.1.4-0300, X750 4.3.7, SFT1200 4.3.7, XE300 4.3.7, MT1300 4.3.10, AR750 4.3.10, AR750S 4.3.10, AR300M 4.3.10, AR300M16 4.3.10, B1300 4.3.10, MT300N-v2 4.3.10, X300B 3.217, S1300 3.216, SF1200 3.216, MV1000 3.216, N300 3.216, B2200 3.216, and X1200 3.203.","published":"2024-02-27T01:15:07.000Z","lastModified":"2026-06-17T07:19:43.000Z","status":"Analyzed","sourceIdentifier":"cve@mitre.org","cvss":{"version":"3.1","score":7.5,"severity":"HIGH","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"},"cwe":["CWE-200"],"affected":["gl-inet/mt6000 firmware","gl-inet/xe3000 firmware","gl-inet/x3000 firmware","gl-inet/mt3000 firmware","gl-inet/mt2500 firmware","gl-inet/axt1800 firmware","gl-inet/ax1800 firmware","gl-inet/a1300 firmware","gl-inet/s200 firmware","gl-inet/x750 firmware","gl-inet/sft1200 firmware","gl-inet/xe300 firmware","gl-inet/mt1300 firmware","gl-inet/ar750 firmware","gl-inet/ar750s firmware","gl-inet/ar300m firmware","gl-inet/ar300m16 firmware","gl-inet/b1300 firmware","gl-inet/mt300n-v2 firmware","gl-inet/x300b firmware","gl-inet/s1300 firmware","gl-inet/sf1200 firmware","gl-inet/mv1000 firmware","gl-inet/n300 firmware","gl-inet/b2200 firmware","gl-inet/x1200 firmware"],"epss":{"score":0.23905,"percentile":0.97822,"date":"2026-10-27","history":[]},"kev":{"listed":false},"exploits":{"count":1,"verified":false,"firstPublished":"2024-04-02","source":"Exploit-DB (https://gitlab.com/exploit-database/exploitdb)","entries":[{"edbId":51942,"kind":"exploit","title":"GL-iNet MT6000 4.5.5 - Arbitrary File Download","url":"https://www.exploit-db.com/exploits/51942","sourceUrl":"https://gitlab.com/exploit-database/exploitdb/-/blob/main/exploits/hardware/remote/51942.py","file":"exploits/hardware/remote/51942.py","published":"2024-04-02","added":"2024-04-02","updated":"2024-04-02","author":"Bandar Alharbi","type":"remote","platform":"hardware","port":null,"verified":false,"codes":["CVE-2024-27356"],"tags":null,"aliases":null,"applicationUrl":null,"screenshotUrl":null,"referenceUrl":null}]},"verdict":{"level":"urgent","text":"EPSS puts the probability of exploitation in the next 30 days at 23.9%, higher than 98% of all known CVEs. Patch or mitigate before the next change window."},"changes":[],"references":[{"url":"https://github.com/gl-inet/CVE-issues/blob/main/4.0.0/Download_file_vulnerability.md","tags":["Third Party Advisory"],"source":"cve@mitre.org"},{"url":"https://gl-inet.com","tags":["Product"],"source":"cve@mitre.org"},{"url":"https://github.com/gl-inet/CVE-issues/blob/main/4.0.0/Download_file_vulnerability.md","tags":["Third Party Advisory"],"source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://gl-inet.com","tags":["Product"],"source":"af854a3a-2127-422b-91ae-364da2661108"}],"sources":{"nvd":"https://nvd.nist.gov/vuln/detail/CVE-2024-27356","epss":"https://www.first.org/epss/","kev":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","exploitdb":"https://www.exploit-db.com/"},"licence":"CC BY 4.0 — link back to the CVE Explorer if you publish the results; upstream data remains subject to its own terms."}