High severity · published Aug 26, 2024
CVE-2024-28077
A denial-of-service issue was discovered on certain GL-iNet devices
7.5
CVSS
0.4%
EPSS
No
On KEV
Description
A denial-of-service issue was discovered on certain GL-iNet devices. Some websites can detect devices exposed to the external network through DDNS, and consequently obtain the IP addresses and ports of devices that are exposed. By using special usernames and special characters (such as half parentheses or square brackets), one can call the login interface and cause the session-management program to crash, resulting in customers being unable to log into their devices. This affects MT6000 4.5.6, XE3000 4.4.5, X3000 4.4.6, MT3000 4.5.0, MT2500 4.5.0, AXT1800 4.5.0, AX1800 4.5.0, A1300 4.5.0, S200 4.1.4-0300, X750 4.3.7, SFT1200 4.3.7, MT1300 4.3.10, AR750 4.3.10, AR750S 4.3.10, AR300M 4.3.10, AR300M16 4.3.10, B1300 4.3.10, MT300N-V2 4.3.10, and XE300 4.3.16.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
None
Integrity
None
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.4% · higher than 37% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
AF
A1300 Firmware · Gl-inet
4.5.0 · source: NVD
AF
Ar300m Firmware · Gl-inet
4.3.10 · source: NVD
AF
Ar300m16 Firmware · Gl-inet
4.3.10 · source: NVD
AF
Ar750 Firmware · Gl-inet
4.3.10 · source: NVD
AF
Ar750s Firmware · Gl-inet
4.3.10 · source: NVD
AF
Ax1800 Firmware · Gl-inet
4.5.0 · source: NVD
AF
Axt1800 Firmware · Gl-inet
4.5.0 · source: NVD
BF
B1300 Firmware · Gl-inet
4.3.10 · source: NVD
MF
Mt1300 Firmware · Gl-inet
4.3.10 · source: NVD
MF
Mt2500 Firmware · Gl-inet
4.5.0 · source: NVD
MF
Mt3000 Firmware · Gl-inet
4.5.0 · source: NVD
MF
Mt300n-v2 Firmware · Gl-inet
4.3.10 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2024-28077
CVE.org
https://www.cve.org/CVERecord?id=CVE-2024-28077
Third Party Advisory
https://github.com/gl-inet/CVE-issues/blob/main/4.0.0/Denial%20of%20service.md
Product
https://gl-inet.com
More from A1300 Firmware
9.8
CVE-2024-39225
GL-iNet products AR750/AR750S/AR300M/AR300M16/MT300N-V2/B1300/MT1300/SFT1200/X750 v4.3.11, MT3000/MT2500/AXT1800/AX1800/A1300/X300B v4.5.16, XE300 v4.3.16, E750 v4.3.12,…
9.8
CVE-2024-39226
GL-iNet products AR750/AR750S/AR300M/AR300M16/MT300N-V2/B1300/MT1300/SFT1200/X750 v4.3.11, MT3000/MT2500/AXT1800/AX1800/A1300/X300B v4.5.16, XE300 v4.3.16, E750 v4.3.12,…
9.8
CVE-2024-39228
GL-iNet products AR750/AR750S/AR300M/AR300M16/MT300N-V2/B1300/MT1300/SFT1200/X750 v4.3.11, MT3000/MT2500/AXT1800/AX1800/A1300/X300B v4.5.16, XE300 v4.3.16, E750 v4.3.12,…
9.8
CVE-2024-39227
GL-iNet products AR750/AR750S/AR300M/AR300M16/MT300N-V2/B1300/MT1300/SFT1200/X750 v4.3.11, MT3000/MT2500/AXT1800/AX1800/A1300/X300B v4.5.16, XE300 v4.3.16, E750 v4.3.12,…
8.8
CVE-2024-45262
An issue was discovered on certain GL-iNet devices, including MT6000, MT3000, MT2500, AXT1800, and AX1800 4.6.2
