Evil-DB LogoEvil-DB
← All CVEs

CVE-2024-27356

high · 7.5

An issue was discovered on certain GL-iNet devices. Attackers can download files such as logs via commands, potentially obtaining critical user information. This affects MT6000 4.5.5, XE3000 4.4.4, X3000 4.4.5, MT3000 4.5.0, MT2500 4.5.0, AXT1800 4.5.0, AX1800 4.5.0, A1300 4.5.0, S200 4.1.4-0300, X750 4.3.7, SFT1200 4.3.7, XE300 4.3.7, MT1300 4.3.10, AR750 4.3.10, AR750S 4.3.10, AR300M 4.3.10, AR300M16 4.3.10, B1300 4.3.10, MT300N-v2 4.3.10, X300B 3.217, S1300 3.216, SF1200 3.216, MV1000 3.216, N300 3.216, B2200 3.216, and X1200 3.203.

7.5
CVSS
23.9%
EPSS (exploit prob.)
98th
EPSS percentile
2024-02-27
Published

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Weaknesses

CWE-200

Affected products

VendorProductAffected versions
gl-inetmt6000_firmware4.5.5
gl-inetmt6000all versions
gl-inetxe3000_firmware4.4.4
gl-inetxe3000all versions
gl-inetx3000_firmware4.4.5
gl-inetx3000all versions
gl-inetmt3000_firmware4.5.0
gl-inetmt3000all versions
gl-inetmt2500_firmware4.5.0
gl-inetmt2500all versions
gl-inetaxt1800_firmware4.5.0
gl-inetaxt1800all versions
gl-inetax1800_firmware4.5.0
gl-inetax1800all versions
gl-ineta1300_firmware4.5.0
gl-ineta1300all versions
gl-inets200_firmware4.1.4-0300
gl-inets200all versions
gl-inetx750_firmware4.3.7
gl-inetx750all versions
gl-inetsft1200_firmware4.37
gl-inetsft1200all versions
gl-inetxe300_firmware4.3.7
gl-inetxe300all versions
gl-inetmt1300_firmware4.3.10
gl-inetmt1300all versions
gl-inetar750_firmware4.3.10
gl-inetar750all versions
gl-inetar750s_firmware4.3.10
gl-inetar750sall versions
gl-inetar300m_firmware4.3.10
gl-inetar300mall versions
gl-inetar300m16_firmware4.3.10
gl-inetar300m16all versions
gl-inetb1300_firmware4.3.10
gl-inetb1300all versions
gl-inetmt300n-v2_firmware4.3.10
gl-inetmt300n-v2all versions
gl-inetx300b_firmware3.217
gl-inetx300ball versions

Check a specific version with /api/v1/cve/match.

References

Query this programmatically:

curl https://evil-db.io/api/v1/cve/CVE-2024-27356