CVE-2024-45260
Estado: AnalizadaAlta (8)—
An issue was discovered on certain GL-iNet devices, including MT6000, MT3000, MT2500, AXT1800, and AX1800 4.6.2. Users who belong to unauthorized groups can invoke any interface of the device, thereby gaining complete control over it.
CVSS
- Versión: 3.1
- Vector: CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- Puntuación base: 8
Probabilidad de explotación (EPSS)
- Probabilidad de explotación en los próximos 30 días: 4.10%
- Percentil entre todas las CVEs puntuadas: 90
- Fecha de la puntuación: 5/10/2026
EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).
🎯 Técnicas ATT&CK
Cómo se explota esta vulnerabilidad y qué consigue el atacante, en el lenguaje de MITRE ATT&CK.
- Explotación
T1210Exploitation of Remote Serviceslateral movement75 % - Impacto principal
T1078Valid Accountsstealth · persistence · privilege escalation · initial access80 % - Impacto secundario
T1068Exploitation for Privilege Escalationprivilege escalation70 %
Vector AV:A/PR:L indica red adyacente con privilegios locales. Usuarios no autorizados invocan interfaces para control total del dispositivo, escalando desde acceso local a privilegios administrativos del router.
Inferido por nuestro agente de análisis a partir de la descripción oficial, el vector CVSS y la CWE, y comprobado por un supervisor. Puede contener errores.
🛡️ Mitigaciones ATT&CK que cubren estas técnicas
Tecnologías afectadas (21)
Gl-inet — A1300 FirmwareGl-inet — Ar300m16 FirmwareGl-inet — Ar300m FirmwareGl-inet — Ar750 FirmwareGl-inet — Ar750s FirmwareGl-inet — Ax1800 FirmwareGl-inet — Axt1800 FirmwareGl-inet — B1300 FirmwareGl-inet — B3000 FirmwareGl-inet — E750 FirmwareGl-inet — Mt1300 FirmwareGl-inet — Mt2500 FirmwareGl-inet — Mt3000 FirmwareGl-inet — Mt300n-v2 FirmwareGl-inet — Mt6000 FirmwareGl-inet — Sft1200 FirmwareGl-inet — X3000 FirmwareGl-inet — X300b FirmwareGl-inet — X750 FirmwareGl-inet — Xe3000 FirmwareGl-inet — Xe300 Firmware
CWE
- CWE-863
Referencias
JSON original (NVD)
Mostrar
{
"id": "CVE-2024-45260",
"cveTags": [],
"metrics": {
"ssvcV203": [
{
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"ssvcData": {
"id": "CVE-2024-45260",
"role": "CISA Coordinator",
"options": [
{
"exploitation": "poc"
},
{
"automatable": "no"
},
{
"technicalImpact": "total"
}
],
"version": "2.0.3",
"timestamp": "2024-10-28T19:24:33.863289Z"
}
}
],
"cvssMetricV31": [
{
"type": "Secondary",
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"cvssData": {
"scope": "UNCHANGED",
"version": "3.1",
"baseScore": 8,
"attackVector": "ADJACENT_NETWORK",
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"integrityImpact": "HIGH",
"userInteraction": "NONE",
"attackComplexity": "LOW",
"availabilityImpact": "HIGH",
"privilegesRequired": "LOW",
"confidentialityImpact": "HIGH"
},
"impactScore": 5.9,
"exploitabilityScore": 2.1
}
]
},
"affected": [
{
"source": "cve@mitre.org",
"affectedData": [
{
"vendor": "n/a",
"product": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
]
},
{
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"affectedData": [
{
"cpes": [
"cpe:2.3:o:gl-inet:gl-b3000_firmware:*:*:*:*:*:*:*:*"
],
"vendor": "gl-inet",
"product": "gl-b3000_firmware",
"versions": [
{
"status": "affected",
"version": "4.5.18",
"lessThan": "4.5.19",
"versionType": "custom"
}
],
"defaultStatus": "unknown"
},
{
"cpes": [
"cpe:2.3:o:gl-inet:gl-ax1800_firmware:*:*:*:*:*:*:*:*",
"cpe:2.3:o:gl-inet:gl-axt1800_firmware:-:*:*:*:*:*:*:*",
"cpe:2.3:o:gl-inet:gl-mt2500_firmware:-:*:*:*:*:*:*:*",
"cpe:2.3:o:gl-inet:gl-mt3000_firmware:-:*:*:*:*:*:*:*",
"cpe:2.3:o:gl-inet:gl-mt6000_firmware:*:*:*:*:*:*:*:*"
],
"vendor": "gl-inet",
"product": "gl-mt6000_firmware",
"versions": [
{
"status": "affected",
"version": "4.6.2",
"lessThan": "4.6.4",
"versionType": "custom"
}
],
"defaultStatus": "unknown"
},
{
"cpes": [
"cpe:2.3:o:gl-inet:gl-a1300_firmware:-:*:*:*:*:*:*:*",
"cpe:2.3:o:gl-inet:gl-x300b_firmware:-:*:*:*:*:*:*:*"
],
"vendor": "gl-inet",
"product": "gl-x300b_firmware",
"versions": [
{
"status": "affected",
"version": "4.5.17",
"lessThan": "4.5.18",
"versionType": "custom"
}
],
"defaultStatus": "unknown"
},
{
"cpes": [
"cpe:2.3:o:gl-inet:gl-x3000_firmware:-:*:*:*:*:*:*:*",
"cpe:2.3:o:gl-inet:gl-xe300_firmware:-:*:*:*:*:*:*:*"
],
"vendor": "gl-inet",
"product": "gl-xe300_firmware",
"versions": [
{
"status": "affected",
"version": "4.4.9",
"lessThan": "4.4.10",
"versionType": "custom"
}
],
"defaultStatus": "unknown"
},
{
"cpes": [
"cpe:2.3:o:gl-inet:gl-mt1300_firmware:-:*:*:*:*:*:*:*",
"cpe:2.3:o:gl-inet:gl-sft1200_firmware:-:*:*:*:*:*:*:*",
"cpe:2.3:o:gl-inet:gl-x750_firmware:-:*:*:*:*:*:*:*"
],
"vendor": "gl-inet",
"product": "gl-x750_firmware",
"versions": [
{
"status": "affected",
"version": "4.3.18",
"lessThan": "4.3.19",
"versionType": "custom"
}
],
"defaultStatus": "unknown"
},
{
"cpes": [
"cpe:2.3:o:gl-inet:gl-ar300m16_firmware:*:*:*:*:*:*:*:*",
"cpe:2.3:o:gl-inet:gl-ar750_firmware:-:*:*:*:*:*:*:*",
"cpe:2.3:o:gl-inet:gl-ar300m_firmware:-:*:*:*:*:*:*:*",
"cpe:2.3:o:gl-inet:gl-ar750s_firmware:-:*:*:*:*:*:*:*",
"cpe:2.3:o:gl-inet:gl-b1300_firmware:-:*:*:*:*:*:*:*",
"cpe:2.3:o:gl-inet:gl-e750_firmware:-:*:*:*:*:*:*:*",
"cpe:2.3:o:gl-inet:gl-mt300n-v2_firmware:-:*:*:*:*:*:*:*",
"cpe:2.3:o:gl-inet:gl-xe300_firmware:-:*:*:*:*:*:*:*"
],
"vendor": "gl-inet",
"product": "gl-xe300_firmware",
"versions": [
{
"status": "affected",
"version": "4.3.17",
"lessThan": "4.3.18",
"versionType": "custom"
}
],
"defaultStatus": "unknown"
}
]
}
],
"published": "2024-10-24T21:15:11.977",
"references": [
{
"url": "https://github.com/gl-inet/CVE-issues/blob/main/4.0.0/Unauthorized%20Access%20to%20File%20Download%20and%20Upload%20Interfaces.md",
"tags": [
"Exploit",
"Third Party Advisory"
],
"source": "cve@mitre.org"
}
],
"vulnStatus": "Analyzed",
"weaknesses": [
{
"type": "Secondary",
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"description": [
{
"lang": "en",
"value": "CWE-863"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "An issue was discovered on certain GL-iNet devices, including MT6000, MT3000, MT2500, AXT1800, and AX1800 4.6.2. Users who belong to unauthorized groups can invoke any interface of the device, thereby gaining complete control over it."
},
{
"lang": "es",
"value": "Se descubrió un problema en ciertos dispositivos GL-iNet, incluidos MT6000, MT3000, MT2500, AXT1800 y AX1800 4.6.2. Los usuarios que pertenecen a grupos no autorizados pueden invocar cualquier interfaz del dispositivo y, de esta manera, obtener control total sobre él."
}
],
"lastModified": "2026-06-17T07:53:52.597",
"configurations": [
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:o:gl-inet:mt6000_firmware:4.6.2:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "E548391D-3E1D-4A8C-8F7C-8740EAD5CB9E"
}
],
"operator": "OR"
},
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:h:gl-inet:mt6000:-:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "CCDE99A6-DA15-4E4B-8C60-CCB9D580BD82"
}
],
"operator": "OR"
},
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:o:gl-inet:b1300_firmware:4.3.17:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "425AB7BB-4BFC-463F-A0B8-9B1CC7A47FAD"
}
],
"operator": "OR"
},
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:h:gl-inet:b1300:-:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "A47EFE3F-D217-469E-BEE6-5D78037C71C3"
}
],
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:o:gl-inet:mt2500_firmware:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "A8537E0A-8726-4355-AA99-06445A43D4D5",
"versionEndExcluding": "4.6.4",
"versionStartIncluding": "4.6.2"
}
],
"operator": "OR"
},
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:h:gl-inet:mt2500:-:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "3ADF5BF3-0F52-4947-8BC2-3505EDEEDF28"
}
],
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:o:gl-inet:axt1800_firmware:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "4607385A-CD71-4809-A143-EE2E9DE0F69A",
"versionEndExcluding": "4.6.4",
"versionStartIncluding": "4.6.2"
}
],
"operator": "OR"
},
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:h:gl-inet:axt1800:-:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "FF453954-BC32-4577-8CE4-066812193495"
}
],
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:o:gl-inet:ax1800_firmware:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "81DEAE12-BC9B-40C5-9D51-25A478670A73",
"versionEndExcluding": "4.6.4",
"versionStartIncluding": "4.6.2"
}
],
"operator": "OR"
},
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:h:gl-inet:ax1800:-:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "BCB312FD-370C-4DF9-961F-F0C4920AA368"
}
],
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:o:gl-inet:b3000_firmware:4.5.18:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "38EDCC99-D442-4FC5-B9DC-5CF38B6EE1FA"
}
],
"operator": "OR"
},
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:h:gl-inet:b3000:-:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "4EA9AD80-5B5E-4736-9146-5F58212D2988"
}
],
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:o:gl-inet:a1300_firmware:4.5.17:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "B48595C6-E07A-4E74-B695-D6D679B6A3ED"
}
],
"operator": "OR"
},
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:h:gl-inet:a1300:-:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "D6DBF472-E98E-4E00-B6A0-6D8FA1678AEA"
}
],
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:o:gl-inet:x300b_firmware:4.5.17:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "B3FAB581-A524-4521-A293-84DD106543C5"
}
],
"operator": "OR"
},
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:h:gl-inet:x300b:-:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "B2AA4BAC-C6D1-42C0-94E9-5B05AC24A235"
}
],
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:o:gl-inet:x3000_firmware:4.4.9:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "F075420C-AD43-475E-8398-114AAA4002EE"
}
],
"operator": "OR"
},
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:h:gl-inet:x3000:-:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "9479FFAA-9C87-4530-884D-B96055A3D41C"
}
],
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:o:gl-inet:xe3000_firmware:4.4.9:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "998569E6-B905-4195-B333-FFFB255EA1FC"
}
],
"operator": "OR"
},
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:h:gl-inet:xe3000:-:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "265EDD5D-B879-4E8A-A6DE-400BC6273A41"
}
],
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:o:gl-inet:x750_firmware:4.3.18:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "A48B5B4A-D6E1-478C-B983-FFD1AC9AA4F0"
}
],
"operator": "OR"
},
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:h:gl-inet:x750:-:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "3D1EDFF0-F67C-4801-815C-309940BD7338"
}
],
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:o:gl-inet:sft1200_firmware:4.3.18:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "334563F9-7746-48A4-9E37-0AF55F44DC6A"
}
],
"operator": "OR"
},
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:h:gl-inet:sft1200:-:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "E656351D-E06E-435F-B1E5-34B89FD8B54B"
}
],
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:o:gl-inet:mt1300_firmware:4.3.18:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "744B2B01-1F28-429F-A898-056470D0DFE1"
}
],
"operator": "OR"
},
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:h:gl-inet:mt1300:-:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "5CECA41F-E807-4234-8C41-477DE132210E"
}
],
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:o:gl-inet:e750_firmware:4.3.17:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "64F877D5-D386-4390-8B32-E7110C6E7463"
}
],
"operator": "OR"
},
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:h:gl-inet:e750:-:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "2D3590B0-7F4B-49C2-BE77-57AD27A91018"
}
],
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:o:gl-inet:xe300_firmware:4.3.17:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "8CE85DAF-B5ED-4D5B-A009-BC7FA2AD0F92"
}
],
"operator": "OR"
},
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:h:gl-inet:xe300:-:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "57D82B62-F057-42A4-8530-86145AE91AC2"
}
],
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:o:gl-inet:ar750_firmware:4.3.17:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "E5BC42BD-03FA-45C1-A7D9-BA9DBE68B7A4"
}
],
"operator": "OR"
},
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:h:gl-inet:ar750:-:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "749A6936-392E-430C-ABD3-33D4C5B3D178"
}
],
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:o:gl-inet:ar750s_firmware:4.3.17:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "1406DB81-E531-4648-B427-AB98793BC76A"
}
],
"operator": "OR"
},
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:h:gl-inet:ar750s:-:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "F18E5F1D-55CD-4F6A-A349-90DD27B29955"
}
],
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:o:gl-inet:ar300m_firmware:4.3.17:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "EB18BA54-1E3A-42DE-A4BD-07A96CE04663"
}
],
"operator": "OR"
},
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:h:gl-inet:ar300m:-:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "F040AC86-5D7A-4E57-B272-A425DDDE1698"
}
],
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:o:gl-inet:mt300n-v2_firmware:4.3.17:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "32494D06-2D09-4A26-B9AF-69F0682638D9"
}
],
"operator": "OR"
},
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:h:gl-inet:mt300n-v2:-:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "797DD304-0AF8-4E2C-8F72-ADF31B8AD6F4"
}
],
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:o:gl-inet:mt3000_firmware:4.6.2:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "18C5A721-8F18-450A-8BA9-01AAFECBE5A1"
}
],
"operator": "OR"
},
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:h:gl-inet:gl-mt3000:-:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "4D832083-488B-40F2-8D7A-66E917DF67F9"
}
],
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:o:gl-inet:ar300m16_firmware:4.3.17:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "C6BD86A8-D5BA-41D8-BA9F-7228DE2C86F5"
}
],
"operator": "OR"
},
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:h:gl-inet:ar300m16:-:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "FA3E349B-C40F-4DE6-B977-CF677B2F9814"
}
],
"operator": "OR"
}
],
"operator": "AND"
}
],
"sourceIdentifier": "cve@mitre.org"
}