What’s Vulnerable › Vulnerabilities

CVE-2024-39227

• Severity: critical (CVSS 9.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 1.2% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2024-08-06 · updated 2026-06-17
• Weakness: CWE-74

Description

GL-iNet products AR750/AR750S/AR300M/AR300M16/MT300N-V2/B1300/MT1300/SFT1200/X750 v4.3.11, MT3000/MT2500/AXT1800/AX1800/A1300/X300B v4.5.16, XE300 v4.3.16, E750 v4.3.12, AP1300/S1300 v4.3.13, and XE3000/X3000 v4.4 were discovered to contain insecure permissions in the endpoint /cgi-bin/glc. This vulnerability allows unauthenticated attackers to execute arbitrary code or possibly a directory traversal via crafted JSON data.

Affected products

• GL-iNet A1300 Firmware: 4.5.16
• GL-iNet Ap1300 Firmware: 3.217
• GL-iNet Ar300M16 Firmware: 4.3.11
• GL-iNet Ar300M Firmware: 4.3.11
• GL-iNet Ar750 Firmware: 4.3.11
• GL-iNet Ar750S Firmware: 4.3.11
• GL-iNet Ax1800 Firmware: 4.5.16
• GL-iNet Axt1800 Firmware: 4.5.16
• GL-iNet B1300 Firmware: 4.3.11
• GL-iNet B2200 Firmware: 3.216
• GL-iNet E750 Firmware: 4.3.12
• GL-iNet Mt1300 Firmware: 4.3.11
• GL-iNet Mt2500 Firmware: 4.5.16
• GL-iNet Mt3000 Firmware: 4.5.16
• GL-iNet Mt300N-V2 Firmware: 4.3.11
• GL-iNet Mt6000 Firmware: 4.5.8
• GL-iNet Mv1000 Firmware: 3.216
• GL-iNet Mv1000W Firmware: 3.216
• GL-iNet N300 Firmware: 3.216
• GL-iNet S1300 Firmware: 3.216
• GL-iNet Sf1200 Firmware: 3.216
• GL-iNet Sft1200 Firmware: 4.3.11
• GL-iNet Usb150 Firmware: 3.216
• GL-iNet X3000 Firmware: 4.4.8
• GL-iNet X300B Firmware: 4.5.16
• GL-iNet X750 Firmware: 4.3.11
• GL-iNet Xe3000 Firmware: 4.4.8
• GL-iNet Xe300 Firmware: 4.3.16

References

• https://github.com/gl-inet/CVE-issues/blob/main/4.0.0/Access%20to%20the%20C%20library%20without%20logging%20in.md

Get alerted when CVE-2024-39227 or the next vulnerability affects your stack