CVE-2024-45262

HighCVSS 8.8/10Last modified Jun 17, 2026

Description

An issue was discovered on certain GL-iNet devices, including MT6000, MT3000, MT2500, AXT1800, and AX1800 4.6.2. The params parameter in the call method of the /rpc endpoint is vulnerable to arbitrary directory traversal, which enables attackers to execute scripts under any path.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-22

Affected software

Vendor	Product	Versions
n/a	n/a	n/a
gl-inet	gl-b3000_firmware	>= 4.5.18, < 4.5.19
gl-inet	gl-mt6000_firmware	>= 4.6.2, < 4.6.4
gl-inet	gl-x300b_firmware	>= 4.5.17, < 4.5.18
gl-inet	gl-xe300_firmware	>= 4.4.9, < 4.4.10
gl-inet	gl-x750_firmware	>= 4.3.18, < 4.3.19
gl-inet	gl-xe300_firmware	>= 4.3.17, < 4.3.18

References

https://github.com/gl-inet/CVE-issues/blob/main/4.0.0/Improper%20Pathname%20Restriction%20Leading%20to%20Path%20Traversal%20in%20Restricted%20Directories.mdExploit, Third Party Advisory

Timeline

Published: Oct 24, 2024
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2024

CVE-2024-452638.8An issue was discovered on certain GL-iNet devices, including MT6000, MT3000, MT2500, AXT1800, and AX1800 4.6.2. The upload interface allows CVE-2024-452648.8A cross-site request forgery (CSRF) vulnerability in the admin panel in SkySystem Arfa-CMS before 5.1.3124 allows remote attackers to add a CVE-2024-452659.8A SQL injection vulnerability in the poll component in SkySystem Arfa-CMS before 5.1.3124 allows remote attackers to execute arbitrary SQL c CVE-2024-452694.3WordPress plugin "Carousel Slider" provided by Sayful Islam contains a cross-site request forgery vulnerability on Carousel image selection CVE-2024-45276.1A vulnerability was found in Campcodes Complete Web-Based School Management System 1.0. It has been classified as problematic. Affected is a CVE-2024-452704.3WordPress plugin "Carousel Slider" provided by Sayful Islam contains a cross-site request forgery vulnerability on Hero image selection feat CVE-2024-452717.8An unauthenticated local attacker can gain admin privileges by deploying a config file due to improper input validation.CVE-2024-452727.5An unauthenticated remote attacker can perform a brute-force attack on the credentials of the remote service portal with a high chance of su CVE-2024-452737.8An unauthenticated local attacker can decrypt the devices config file and therefore compromise the device due to a weak implementation of th CVE-2024-452749.8An unauthenticated remote attacker can execute OS commands via UDP on the device due to missing authentication.CVE-2024-452759.8The devices contain two hard coded user accounts with hardcoded passwords that allow an unauthenticated remote attacker for full control of CVE-2024-452767.5An unauthenticated remote attacker can get read access to files in the "/tmp" directory due to missing authentication.