CVE-2024-39225
GL-iNet products AR750/AR750S/AR300M/AR300M16/MT300N-V2/B1300/MT1300/SFT1200/X750 v4.3.11, MT3000/MT2500/AXT1800/AX1800/A1300/X300B v4.5.16, XE300 v4.3.16, E750 v4.3.12, AP1300/S1300 v4.3.13, and XE3000/X3000 v4.4 were discovered to contain a remote…
Does this matter?
EPSS puts the probability of exploitation in the next 30 days at 14.4%, higher than 97% of all known CVEs. Patch or mitigate before the next change window.
Description
GL-iNet products AR750/AR750S/AR300M/AR300M16/MT300N-V2/B1300/MT1300/SFT1200/X750 v4.3.11, MT3000/MT2500/AXT1800/AX1800/A1300/X300B v4.5.16, XE300 v4.3.16, E750 v4.3.12, AP1300/S1300 v4.3.13, and XE3000/X3000 v4.4 were discovered to contain a remote code execution (RCE) vulnerability.
- CVSS 3.1
- 9.8 CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- EPSS
- 14.42% probability · 97th percentile
- Public exploits
- None in Exploit-DB
- CISA KEV
- Not listed
- Weakness
- CWE-307
- Affected
- gl-inet/mt6000 firmware · gl-inet/a1300 firmware · gl-inet/x300b firmware · gl-inet/ax1800 firmware · gl-inet/axt1800 firmware · gl-inet/mt2500 firmware · gl-inet/mt3000 firmware · gl-inet/x3000 firmware · gl-inet/xe3000 firmware · gl-inet/xe300 firmware · gl-inet/e750 firmware · gl-inet/x750 firmware · gl-inet/sft1200 firmware · gl-inet/ar300m firmware · gl-inet/ar300m16 firmware · gl-inet/ar750 firmware · gl-inet/ar750s firmware · gl-inet/b1300 firmware · gl-inet/mt1300 firmware · gl-inet/mt300n-v2 firmware · +8 more
- Source
- cve@mitre.org
EPSS 14.4% since 27 October 2026; no change recorded yet. The dashed line is the ten per cent mark our analysts treat as “patch before the next change window”. Points are recorded when the score first appears and whenever it moves by a percentage point or more.
References
- https://github.com/gl-inet/CVE-issues/blob/main/4.0.0/Bypass%20the%20login%20mechanism.mdExploit, Third Party Advisory
Source: NVD record, EPSS from FIRST.org, KEV from CISA, exploits from Exploit-DB. Refreshed daily. Download this record as JSON.