CVE-2024-39225

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

GL-iNet products AR750/AR750S/AR300M/AR300M16/MT300N-V2/B1300/MT1300/SFT1200/X750 v4.3.11, MT3000/MT2500/AXT1800/AX1800/A1300/X300B v4.5.16, XE300 v4.3.16, E750 v4.3.12, AP1300/S1300 v4.3.13, and XE3000/X3000 v4.4 were discovered to contain a remote code execution (RCE) vulnerability.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-307

Affected software

VendorProductVersions
n/an/an/a
gl-inetmt6000_firmware4.5.8
gl-ineta1300_firmware4.5.16
gl-inetx300b_firmware4.5.16
gl-inetax1800_firmware4.5.16
gl-inetaxt1800_firmware4.5.16
gl-inetmt2500_firmware4.5.16
gl-inetmt3000_firmware4.5.16
gl-inetx3000_firmware4.4.8
gl-inetxe3000_firmware4.4.8
gl-inetxe300_firmware4.3.16
gl-inete750_firmware4.3.12
gl-inetx750_firmware4.3.11
gl-inetsft1200_firmware4.3.11
gl-inetar300m_firmware4.3.11
gl-inetar300m16_firmware4.3.11
gl-inetar750_firmware4.3.11
gl-inetar750s_firmware4.3.11
gl-inetb1300_firmware4.3.11
gl-inetmt1300_firmware4.3.11
gl-inetmt300n-v2_firmware4.3.11
gl-inetap1300_firmware3.217
gl-inetb2200_firmware3.216
gl-inetmv1000_firmware3.216
gl-inetmv1000w_firmware3.216
gl-inetusb150_firmware3.216
gl-inetsf1200_firmware3.216
gl-inetn300_firmware3.216
gl-inets1300_firmware3.216

References

Timeline

Published
Aug 6, 2024
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2024

CVE-2024-392269.8GL-iNet products AR750/AR750S/AR300M/AR300M16/MT300N-V2/B1300/MT1300/SFT1200/X750 v4.3.11, MT3000/MT2500/AXT1800/AX1800/A1300/X300B v4.5.16,CVE-2024-392279.8GL-iNet products AR750/AR750S/AR300M/AR300M16/MT300N-V2/B1300/MT1300/SFT1200/X750 v4.3.11, MT3000/MT2500/AXT1800/AX1800/A1300/X300B v4.5.16,CVE-2024-392289.8GL-iNet products AR750/AR750S/AR300M/AR300M16/MT300N-V2/B1300/MT1300/SFT1200/X750 v4.3.11, MT3000/MT2500/AXT1800/AX1800/A1300/X300B v4.5.16,CVE-2024-392295.3An issue in GL-iNet products AR750/AR750S/AR300M/AR300M16/MT300N-V2/B1300/MT1300/SFT1200/X750 v4.3.11, MT3000/MT2500/AXT1800/AX1800/A1300/X3CVE-2024-39235.4The Beaver Builder – WordPress Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the link_target parameter CVE-2024-392369.8Gradio v4.36.1 was discovered to contain a code injection vulnerability via the component /gradio/component_meta.py. This vulnerability is tCVE-2024-39244.4A code injection vulnerability exists in the huggingface/text-generation-inference repository, specifically within the `autodocs.yml` workflCVE-2024-392416.1Cross Site Scripting (XSS) vulnerability in skycaiji 2.8 allows attackers to run arbitrary code via /admin/tool/preview.CVE-2024-392426.1A cross-site scripting (XSS) vulnerability in skycaiji v2.8 allows attackers to execute arbitrary web scripts or HTML via a crafted payload CVE-2024-392439.8An issue discovered in skycaiji 2.8 allows attackers to run arbitrary code via crafted POST request to /index.php?s=/admin/develop/editor_saCVE-2024-392485.4A cross-site scripting (XSS) vulnerability in SimpCMS v0.1 allows attackers to execute arbitrary web scripts or HTML via a crafted payload iCVE-2024-392497.5Async <= 2.6.4 and <= 3.2.5 are vulnerable to ReDoS (Regular Expression Denial of Service) while parsing function in autoinject function. NO
CVE-2024-39225: Critical severity, CVSS 9.8 | Vulnix