CVE-2024-45260

HighCVSS 8.0/10Last modified Jun 17, 2026

Description

An issue was discovered on certain GL-iNet devices, including MT6000, MT3000, MT2500, AXT1800, and AX1800 4.6.2. Users who belong to unauthorized groups can invoke any interface of the device, thereby gaining complete control over it.

Metrics

CVSS 3.1 8.0/10CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-863

Affected software

No affected versions have been published.

Timeline

Published: Oct 24, 2024
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2024

CVE-2024-452618.0An issue was discovered on certain GL-iNet devices, including MT6000, MT3000, MT2500, AXT1800, and AX1800 4.6.2. The SID generated for a spe CVE-2024-452628.8An issue was discovered on certain GL-iNet devices, including MT6000, MT3000, MT2500, AXT1800, and AX1800 4.6.2. The params parameter in the CVE-2024-452638.8An issue was discovered on certain GL-iNet devices, including MT6000, MT3000, MT2500, AXT1800, and AX1800 4.6.2. The upload interface allows CVE-2024-452648.8A cross-site request forgery (CSRF) vulnerability in the admin panel in SkySystem Arfa-CMS before 5.1.3124 allows remote attackers to add a CVE-2024-452659.8A SQL injection vulnerability in the poll component in SkySystem Arfa-CMS before 5.1.3124 allows remote attackers to execute arbitrary SQL c CVE-2024-452694.3WordPress plugin "Carousel Slider" provided by Sayful Islam contains a cross-site request forgery vulnerability on Carousel image selection CVE-2024-45276.1A vulnerability was found in Campcodes Complete Web-Based School Management System 1.0. It has been classified as problematic. Affected is a CVE-2024-452704.3WordPress plugin "Carousel Slider" provided by Sayful Islam contains a cross-site request forgery vulnerability on Hero image selection feat CVE-2024-452717.8An unauthenticated local attacker can gain admin privileges by deploying a config file due to improper input validation.CVE-2024-452727.5An unauthenticated remote attacker can perform a brute-force attack on the credentials of the remote service portal with a high chance of su CVE-2024-452737.8An unauthenticated local attacker can decrypt the devices config file and therefore compromise the device due to a weak implementation of th CVE-2024-452749.8An unauthenticated remote attacker can execute OS commands via UDP on the device due to missing authentication.