CVE-2024-45263

Severity: high (CVSS 8.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.3% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2024-10-24 · updated 2026-06-17
Weakness: CWE-434

Description

An issue was discovered on certain GL-iNet devices, including MT6000, MT3000, MT2500, AXT1800, and AX1800 4.6.2. The upload interface allows the uploading of arbitrary files to the device. Once the device executes the files, it can lead to information leakage, enabling complete control.

Affected products

GL-iNet A1300 Firmware: 4.5.17
GL-iNet Ar300M16 Firmware: 4.3.17
GL-iNet Ar300M Firmware: 4.3.17
GL-iNet Ar750 Firmware: 4.3.17
GL-iNet Ar750S Firmware: 4.3.17
GL-iNet Ax1800 Firmware: from 4.6.2 before 4.6.4 — fixed in 4.6.4
GL-iNet Axt1800 Firmware: from 4.6.2 before 4.6.4 — fixed in 4.6.4
GL-iNet B1300 Firmware: 4.3.17
GL-iNet B3000 Firmware: 4.5.18
GL-iNet E750 Firmware: 4.3.17
GL-iNet Mt1300 Firmware: 4.3.18
GL-iNet Mt2500 Firmware: from 4.6.2 before 4.6.4 — fixed in 4.6.4
GL-iNet Mt3000 Firmware: from 4.6.2 before 4.6.4 — fixed in 4.6.4
GL-iNet Mt300N-V2 Firmware: 4.3.17
GL-iNet Mt6000 Firmware: 4.6.2
GL-iNet Sft1200 Firmware: 4.3.18
GL-iNet X3000 Firmware: 4.4.9
GL-iNet X300B Firmware: 4.5.17
GL-iNet X750 Firmware: 4.3.18
GL-iNet Xe3000 Firmware: 4.4.9
GL-iNet Xe300 Firmware: 4.3.17

How to fix

Upgrade to a fixed version: GL-iNet Ax1800 Firmware 4.6.4; GL-iNet Axt1800 Firmware 4.6.4; GL-iNet Mt2500 Firmware 4.6.4; GL-iNet Mt3000 Firmware 4.6.4. Check the vendor advisory for mitigations.

References

https://github.com/gl-inet/CVE-issues/blob/main/4.0.0/Arbitrary%20File%20Upload%20to%20ovpn_upload%20via%20Upload%20Interface.md

Get alerted when CVE-2024-45263 or the next vulnerability affects your stack