CVE-2024-28077
A denial-of-service issue was discovered on certain GL-iNet devices.
Does this matter?
High impact if exploited, but EPSS currently rates exploitation as unlikely (0.43%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.
Description
A denial-of-service issue was discovered on certain GL-iNet devices. Some websites can detect devices exposed to the external network through DDNS, and consequently obtain the IP addresses and ports of devices that are exposed. By using special usernames and special characters (such as half parentheses or square brackets), one can call the login interface and cause the session-management program to crash, resulting in customers being unable to log into their devices. This affects MT6000 4.5.6, XE3000 4.4.5, X3000 4.4.6, MT3000 4.5.0, MT2500 4.5.0, AXT1800 4.5.0, AX1800 4.5.0, A1300 4.5.0, S200 4.1.4-0300, X750 4.3.7, SFT1200 4.3.7, MT1300 4.3.10, AR750 4.3.10, AR750S 4.3.10, AR300M 4.3.10, AR300M16 4.3.10, B1300 4.3.10, MT300N-V2 4.3.10, and XE300 4.3.16.
- CVSS 3.1
- 7.5 HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- EPSS
- 0.43% probability · 36th percentile
- CISA KEV
- Not listed
- Affected
- gl-inet/mt6000 firmware · gl-inet/x3000 firmware · gl-inet/xe3000 firmware · gl-inet/a1300 firmware · gl-inet/ax1800 firmware · gl-inet/axt1800 firmware · gl-inet/mt2500 firmware · gl-inet/mt3000 firmware · gl-inet/xe300 firmware · gl-inet/x750 firmware · gl-inet/sft1200 firmware · gl-inet/ar300m firmware · gl-inet/ar300m16 firmware · gl-inet/ar750 firmware · gl-inet/ar750s firmware · gl-inet/b1300 firmware · gl-inet/mt1300 firmware · gl-inet/mt300n-v2 firmware
- Source
- cve@mitre.org
References
- https://github.com/gl-inet/CVE-issues/blob/main/4.0.0/Denial%20of%20service.mdThird Party Advisory
- https://gl-inet.comProduct
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.