Gl-xe300 Firmware vulnerabilities
7 known vulnerabilities in Gl-xe300 Firmware from GL.iNet. 7 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.
Latest first
- 8.8 High severity
gl-b3000_firmware: Unrestricted Upload of File with Dangerous Type
An issue was discovered on certain GL-iNet devices, including MT6000, MT3000, MT2500, AXT1800, and AX1800 4.6.2. The upload interface allows the uploading of arbitrary files to the device. Once the device executes the files, it can lead to information leakage,
- 8.8 High severity
gl-b3000_firmware: Improper Limitation of a Pathname to a Restricted Directory
An issue was discovered on certain GL-iNet devices, including MT6000, MT3000, MT2500, AXT1800, and AX1800 4.6.2. The params parameter in the call method of the /rpc endpoint is vulnerable to arbitrary directory traversal, which enables attackers to execute scr
- 8.0 High severity
gl-b3000_firmware: Incorrect Authorization
An issue was discovered on certain GL-iNet devices, including MT6000, MT3000, MT2500, AXT1800, and AX1800 4.6.2. The SID generated for a specific user is not tied to that user itself, which allows other users to potentially use it for authentication. Once an a
- 8.0 High severity
gl-b3000_firmware: Incorrect Authorization
An issue was discovered on certain GL-iNet devices, including MT6000, MT3000, MT2500, AXT1800, and AX1800 4.6.2. Users who belong to unauthorized groups can invoke any interface of the device, thereby gaining complete control over it.
- 9.8 Critical severity
Gl-s20 Firmware: Buffer Copy without Checking Size of Input
An issue was discovered on GL.iNet devices before 3.216. The function guci2_get() found in libglutil.so has a buffer overflow when an item is requested from a UCI context, and the value is pasted into a char pointer to a buffer without checking the size of the
- 7.5 High severity
Gl-s20 Firmware: Improper Limitation of a Pathname to a Restricted Directory
A path traversal issue was discovered on GL.iNet devices before 3.216. Through the file sharing feature, it is possible to share an arbitrary directory, such as /tmp or /etc, because there is no server-side restriction to limit sharing to the USB path.
- 7.5 High severity
Gl-s20 Firmware: Allocation of Resources Without Limits or Throttling
An issue was discovered on GL.iNet devices before 3.216. There is an arbitrary file write in which an empty file can be created anywhere on the filesystem. This is caused by a command injection vulnerability with a filter applied.