E750 Firmware vulnerabilities

8 known vulnerabilities in E750 Firmware from GL.iNet. 8 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

8vulnerabilities

4critical

4high

0exploited

9.1average CVSS score

Latest first

8.8 High severity
gl-b3000_firmware: Unrestricted Upload of File with Dangerous Type
CVE-2024-45263Oct 24, 2024GL.iNet
An issue was discovered on certain GL-iNet devices, including MT6000, MT3000, MT2500, AXT1800, and AX1800 4.6.2. The upload interface allows the uploading of arbitrary files to the device. Once the device executes the files, it can lead to information leakage,
8.8 High severity
gl-b3000_firmware: Improper Limitation of a Pathname to a Restricted Directory
CVE-2024-45262Oct 24, 2024GL.iNet
An issue was discovered on certain GL-iNet devices, including MT6000, MT3000, MT2500, AXT1800, and AX1800 4.6.2. The params parameter in the call method of the /rpc endpoint is vulnerable to arbitrary directory traversal, which enables attackers to execute scr
8.0 High severity
gl-b3000_firmware: Incorrect Authorization
CVE-2024-45261Oct 24, 2024GL.iNet
An issue was discovered on certain GL-iNet devices, including MT6000, MT3000, MT2500, AXT1800, and AX1800 4.6.2. The SID generated for a specific user is not tied to that user itself, which allows other users to potentially use it for authentication. Once an a
8.0 High severity
gl-b3000_firmware: Incorrect Authorization
CVE-2024-45260Oct 24, 2024GL.iNetEPSS 4.1%
An issue was discovered on certain GL-iNet devices, including MT6000, MT3000, MT2500, AXT1800, and AX1800 4.6.2. Users who belong to unauthorized groups can invoke any interface of the device, thereby gaining complete control over it.
9.8 Critical severity
gl-mt2500: Improper Neutralization of Special Elements in Output Used by a Downstream Component
CVE-2024-39227Aug 6, 2024GL.iNetEPSS 1.19%
GL-iNet products AR750/AR750S/AR300M/AR300M16/MT300N-V2/B1300/MT1300/SFT1200/X750 v4.3.11, MT3000/MT2500/AXT1800/AX1800/A1300/X300B v4.5.16, XE300 v4.3.16, E750 v4.3.12, AP1300/S1300 v4.3.13, and XE3000/X3000 v4.4 were discovered to contain insecure permission
9.8 Critical severity
x750_firmware: Improper Neutralization of Special Elements used in an OS Command
CVE-2024-39228Aug 6, 2024GL.iNet
GL-iNet products AR750/AR750S/AR300M/AR300M16/MT300N-V2/B1300/MT1300/SFT1200/X750 v4.3.11, MT3000/MT2500/AXT1800/AX1800/A1300/X300B v4.5.16, XE300 v4.3.16, E750 v4.3.12, AP1300/S1300 v4.3.13, and XE3000/X3000 v4.4 were discovered to contain a shell injection v
9.8 Critical severity
Mt6000 Firmware: Improper Limitation of a Pathname to a Restricted Directory
CVE-2024-39226Aug 6, 2024GL.iNetEPSS 20.4%
GL-iNet products AR750/AR750S/AR300M/AR300M16/MT300N-V2/B1300/MT1300/SFT1200/X750 v4.3.11, MT3000/MT2500/AXT1800/AX1800/A1300/X300B v4.5.16, XE300 v4.3.16, E750 v4.3.12, AP1300/S1300 v4.3.13, and XE3000/X3000 v4.4 were discovered to contain a vulnerability can
9.8 Critical severity
mt6000_firmware: Improper Restriction of Excessive Authentication Attempts
CVE-2024-39225Aug 6, 2024GL.iNetEPSS 14.4%
GL-iNet products AR750/AR750S/AR300M/AR300M16/MT300N-V2/B1300/MT1300/SFT1200/X750 v4.3.11, MT3000/MT2500/AXT1800/AX1800/A1300/X300B v4.5.16, XE300 v4.3.16, E750 v4.3.12, AP1300/S1300 v4.3.13, and XE3000/X3000 v4.4 were discovered to contain a remote code execu