Filtered by vendor Gl-inet Subscriptions

Search

Switch to Advanced Search (Beta)
Total 58 CVE
CVE Vendors Products Updated CVSS v3.1
CVE-2023-24261 1 Gl-inet 2 Gl-e750, Gl-e750 Firmware 2024-12-06 7.2 High
A vulnerability in GL.iNET GL-E750 Mudi before firmware v3.216 allows authenticated attackers to execute arbitrary code via a crafted POST request.
CVE-2024-39229 1 Gl-inet 56 A1300, A1300 Firmware, Ap1300 and 53 more 2024-11-21 6.5 Medium
An issue in GL-iNet products AR750/AR750S/AR300M/AR300M16/MT300N-V2/B1300/MT1300/SFT1200/X750 v4.3.11, MT3000/MT2500/AXT1800/AX1800/A1300/X300B v4.5.16, XE300 v4.3.16, E750 v4.3.12, AP1300/S1300 v4.3.13, XE3000/X3000 v4, and B2200/MV1000/MV1000W/USB150/N300/SF1200 v3.216 allows attackers to intercept communications via a man-in-the-middle attack when DDNS clients are reporting data to the server.
CVE-2023-50445 2 Gl-inet, Gl.inet 36 Gl-a1300, Gl-a1300 Firmware, Gl-ar300m and 33 more 2024-11-21 7.8 High
Shell Injection vulnerability GL.iNet A1300 v4.4.6, AX1800 v4.4.6, AXT1800 v4.4.6, MT3000 v4.4.6, MT2500 v4.4.6, MT6000 v4.5.0, MT1300 v4.3.7, MT300N-V2 v4.3.7, AR750S v4.3.7, AR750 v4.3.7, AR300M v4.3.7, and B1300 v4.3.7., allows local attackers to execute arbitrary code via the get_system_log and get_crash_log functions of the logread module, as well as the upgrade_online function of the upgrade module.
CVE-2023-47464 1 Gl-inet 2 Gl-ax1800, Gl-ax1800 Firmware 2024-11-21 8.8 High
Insecure Permissions vulnerability in GL.iNet AX1800 version 4.0.0 before 4.5.0 allows a remote attacker to execute arbitrary code via the upload API function.
CVE-2023-47463 1 Gl-inet 2 Gl-ax1800, Gl-ax1800 Firmware 2024-11-21 9.8 Critical
Insecure Permissions vulnerability in GL.iNet AX1800 version 4.0.0 before 4.5.0 allows a remote attacker to execute arbitrary code via a crafted script to the gl_nas_sys authentication function.
CVE-2023-47462 1 Gl-inet 2 Gl-ax1800, Gl-ax1800 Firmware 2024-11-21 9.8 Critical
Insecure Permissions vulnerability in GL.iNet AX1800 v.3.215 and before allows a remote attacker to execute arbitrary code via the file sharing function.
CVE-2023-46456 1 Gl-inet 2 Gl-ar300m, Gl-ar300m Firmware 2024-11-21 9.8 Critical
In GL.iNET GL-AR300M routers with firmware 3.216 it is possible to inject arbitrary shell commands through the OpenVPN client file upload functionality.
CVE-2023-46455 1 Gl-inet 2 Gl-ar300m, Gl-ar300m Firmware 2024-11-21 7.5 High
In GL.iNET GL-AR300M routers with firmware v4.3.7 it is possible to write arbitrary files through a path traversal attack in the OpenVPN client file upload functionality.
CVE-2023-46454 1 Gl-inet 2 Gl-ar300m, Gl-ar300m Firmware 2024-11-21 9.8 Critical
In GL.iNET GL-AR300M routers with firmware v4.3.7, it is possible to inject arbitrary shell commands through a crafted package name in the package information functionality.
CVE-2021-44148 1 Gl-inet 2 Gl-ar150, Gl-ar150 Firmware 2024-11-21 6.1 Medium
GL.iNet GL-AR150 2.x before 3.x devices, configured as repeaters, allow cgi-bin/router_cgi?action=scanwifi XSS when an attacker creates an SSID with an XSS payload as the name.
CVE-2019-6275 1 Gl-inet 2 Gl-ar300m-lite, Gl-ar300m-lite Firmware 2024-11-21 N/A
Command injection vulnerability in firmware_cgi in GL.iNet GL-AR300M-Lite devices with firmware 2.27 allows remote attackers to execute arbitrary code.
CVE-2019-6274 1 Gl-inet 2 Gl-ar300m-lite, Gl-ar300m-lite Firmware 2024-11-21 N/A
Directory traversal vulnerability in storage_cgi in GL.iNet GL-AR300M-Lite devices with firmware 2.27 allows remote attackers to have unspecified impact via directory traversal sequences.
CVE-2019-6273 1 Gl-inet 2 Gl-ar300m-lite, Gl-ar300m-lite Firmware 2024-11-21 N/A
download_file in GL.iNet GL-AR300M-Lite devices with firmware 2.27 allows remote attackers to download arbitrary files.
CVE-2019-6272 1 Gl-inet 2 Gl-ar300m-lite, Gl-ar300m-lite Firmware 2024-11-21 N/A
Command injection vulnerability in login_cgi in GL.iNet GL-AR300M-Lite devices with firmware 2.27 allows remote attackers to execute arbitrary code.
CVE-2024-39226 1 Gl-inet 56 A1300, A1300 Firmware, Ap1300 and 53 more 2024-11-12 4.3 Medium
GL-iNet products AR750/AR750S/AR300M/AR300M16/MT300N-V2/B1300/MT1300/SFT1200/X750 v4.3.11, MT3000/MT2500/AXT1800/AX1800/A1300/X300B v4.5.16, XE300 v4.3.16, E750 v4.3.12, AP1300/S1300 v4.3.13, and XE3000/X3000 v4.4 were discovered to contain a vulnerability can be exploited to manipulate routers by passing malicious shell commands through the s2s API.
CVE-2024-39228 1 Gl-inet 57 A1300, A1300 Firmware, Ap1300 and 54 more 2024-08-15 9.8 Critical
GL-iNet products AR750/AR750S/AR300M/AR300M16/MT300N-V2/B1300/MT1300/SFT1200/X750 v4.3.11, MT3000/MT2500/AXT1800/AX1800/A1300/X300B v4.5.16, XE300 v4.3.16, E750 v4.3.12, AP1300/S1300 v4.3.13, and XE3000/X3000 v4.4 were discovered to contain a shell injection vulnerability via the interface check_ovpn_client_config and check_config.
CVE-2024-39227 1 Gl-inet 77 A1300, A1300 Firmware, Ap1300 and 74 more 2024-08-15 9.8 Critical
GL-iNet products AR750/AR750S/AR300M/AR300M16/MT300N-V2/B1300/MT1300/SFT1200/X750 v4.3.11, MT3000/MT2500/AXT1800/AX1800/A1300/X300B v4.5.16, XE300 v4.3.16, E750 v4.3.12, AP1300/S1300 v4.3.13, and XE3000/X3000 v4.4 were discovered to contain insecure permissions in the endpoint /cgi-bin/glc. This vulnerability allows unauthenticated attackers to execute arbitrary code or possibly a directory traversal via crafted JSON data.
CVE-2024-39225 1 Gl-inet 56 A1300, A1300 Firmware, Ap1300 and 53 more 2024-08-15 9.8 Critical
GL-iNet products AR750/AR750S/AR300M/AR300M16/MT300N-V2/B1300/MT1300/SFT1200/X750 v4.3.11, MT3000/MT2500/AXT1800/AX1800/A1300/X300B v4.5.16, XE300 v4.3.16, E750 v4.3.12, AP1300/S1300 v4.3.13, and XE3000/X3000 v4.4 were discovered to contain a remote code execution (RCE) vulnerability.