CVE-2025-2850
Estado: AplazadaMedia (5.1)—
A vulnerability was found in GL.iNet GL-A1300 Slate Plus, GL-AR300M16 Shadow, GL-AR300M Shadow, GL-AR750 Creta, GL-AR750S-EXT Slate, GL-AX1800 Flint, GL-AXT1800 Slate AX, GL-B1300 Convexa-B, GL-B3000 Marble, GL-BE3600 Slate 7, GL-E750, GL-E750V2 Mudi, GL-MT300N-V2 Mango, GL-MT1300 Beryl, GL-MT2500 Brume 2, GL-MT3000 Beryl AX, GL-MT6000 Flint 2, GL-SFT1200 Opal, GL-X300B Collie, GL-X750 Spitz, GL-X3000 Spitz AX, GL-XE300 Puli and GL-XE3000 Puli AX 4.x. It has been rated as problematic. This issue affects some unknown processing of the component Download Interface. The manipulation leads to improper authorization. It is recommended to upgrade the affected component.
CVSS
- Versión: 4.0
- Vector: CVSS:4.0/AV:A/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
- Puntuación base: 5.1
Probabilidad de explotación (EPSS)
- Probabilidad de explotación en los próximos 30 días: 0.22%
- Percentil entre todas las CVEs puntuadas: 11
- Fecha de la puntuación: 5/10/2026
EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).
Tecnologías afectadas (23)
⚠ Inferidas por IA a partir de la descripción — NVD aún no ha analizado esta CVE; no son CPE verificados.
Gl-inet — Gl-a1300 Slate PlusAIGl-inet — Gl-ar300m16 ShadowAIGl-inet — Gl-ar300m ShadowAIGl-inet — Gl-ar750 CretaAIGl-inet — Gl-ar750s-ext SlateAIGl-inet — Gl-ax1800 FlintAIGl-inet — Gl-axt1800 Slate AXAIGl-inet — Gl-b1300 Convexa-bAIGl-inet — Gl-b3000 MarbleAIGl-inet — Gl-be3600 Slate 7AIGl-inet — Gl-e750AIGl-inet — Gl-e750v2 MudiAIGl-inet — Gl-mt1300 BerylAIGl-inet — Gl-mt2500 Brume 2AIGl-inet — Gl-mt3000 Beryl AXAIGl-inet — Gl-mt300n-v2 MangoAIGl-inet — Gl-mt6000 Flint 2AIGl-inet — Gl-sft1200 OpalAIGl-inet — Gl-x3000 Spitz AXAIGl-inet — Gl-x300b CollieAIGl-inet — Gl-x750 SpitzAIGl-inet — Gl-xe3000 Puli AXAIGl-inet — Gl-xe300 PuliAI
CWE
- CWE-266, CWE-285
Referencias
JSON original (NVD)
Mostrar
{
"id": "CVE-2025-2850",
"cveTags": [],
"metrics": {
"ssvcV203": [
{
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"ssvcData": {
"id": "CVE-2025-2850",
"role": "CISA Coordinator",
"options": [
{
"exploitation": "none"
},
{
"automatable": "no"
},
{
"technicalImpact": "partial"
}
],
"version": "2.0.3",
"timestamp": "2025-04-28T18:07:02.103624Z"
}
}
],
"cvssMetricV2": [
{
"type": "Secondary",
"source": "cna@vuldb.com",
"cvssData": {
"version": "2.0",
"baseScore": 2.7,
"accessVector": "ADJACENT_NETWORK",
"vectorString": "AV:A/AC:L/Au:S/C:P/I:N/A:N",
"authentication": "SINGLE",
"integrityImpact": "NONE",
"accessComplexity": "LOW",
"availabilityImpact": "NONE",
"confidentialityImpact": "PARTIAL"
},
"acInsufInfo": false,
"impactScore": 2.9,
"baseSeverity": "LOW",
"obtainAllPrivilege": false,
"exploitabilityScore": 5.1,
"obtainUserPrivilege": false,
"obtainOtherPrivilege": false,
"userInteractionRequired": false
}
],
"cvssMetricV31": [
{
"type": "Secondary",
"source": "cna@vuldb.com",
"cvssData": {
"scope": "UNCHANGED",
"version": "3.1",
"baseScore": 3.5,
"attackVector": "ADJACENT_NETWORK",
"baseSeverity": "LOW",
"vectorString": "CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
"integrityImpact": "NONE",
"userInteraction": "NONE",
"attackComplexity": "LOW",
"availabilityImpact": "NONE",
"privilegesRequired": "LOW",
"confidentialityImpact": "LOW"
},
"impactScore": 1.4,
"exploitabilityScore": 2.1
}
],
"cvssMetricV40": [
{
"type": "Secondary",
"source": "cna@vuldb.com",
"cvssData": {
"Safety": "NOT_DEFINED",
"version": "4.0",
"Recovery": "NOT_DEFINED",
"baseScore": 5.1,
"Automatable": "NOT_DEFINED",
"attackVector": "ADJACENT",
"baseSeverity": "MEDIUM",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:A/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"exploitMaturity": "NOT_DEFINED",
"providerUrgency": "NOT_DEFINED",
"userInteraction": "NONE",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"privilegesRequired": "LOW",
"subIntegrityImpact": "NONE",
"vulnIntegrityImpact": "NONE",
"integrityRequirement": "NOT_DEFINED",
"modifiedAttackVector": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"vulnAvailabilityImpact": "NONE",
"availabilityRequirement": "NOT_DEFINED",
"modifiedUserInteraction": "NOT_DEFINED",
"modifiedAttackComplexity": "NOT_DEFINED",
"subConfidentialityImpact": "NONE",
"vulnConfidentialityImpact": "LOW",
"confidentialityRequirement": "NOT_DEFINED",
"modifiedAttackRequirements": "NOT_DEFINED",
"modifiedPrivilegesRequired": "NOT_DEFINED",
"modifiedSubIntegrityImpact": "NOT_DEFINED",
"modifiedVulnIntegrityImpact": "NOT_DEFINED",
"vulnerabilityResponseEffort": "NOT_DEFINED",
"modifiedSubAvailabilityImpact": "NOT_DEFINED",
"modifiedVulnAvailabilityImpact": "NOT_DEFINED",
"modifiedSubConfidentialityImpact": "NOT_DEFINED",
"modifiedVulnConfidentialityImpact": "NOT_DEFINED"
}
}
]
},
"affected": [
{
"source": "cna@vuldb.com",
"affectedData": [
{
"vendor": "GL.iNet",
"modules": [
"Download Interface"
],
"product": "GL-A1300 Slate Plus",
"versions": [
{
"status": "affected",
"version": "4.x"
}
]
},
{
"vendor": "GL.iNet",
"modules": [
"Download Interface"
],
"product": "GL-AR300M16 Shadow",
"versions": [
{
"status": "affected",
"version": "4.x"
}
]
},
{
"vendor": "GL.iNet",
"modules": [
"Download Interface"
],
"product": "GL-AR300M Shadow",
"versions": [
{
"status": "affected",
"version": "4.x"
}
]
},
{
"vendor": "GL.iNet",
"modules": [
"Download Interface"
],
"product": "GL-AR750 Creta",
"versions": [
{
"status": "affected",
"version": "4.x"
}
]
},
{
"vendor": "GL.iNet",
"modules": [
"Download Interface"
],
"product": "GL-AR750S-EXT Slate",
"versions": [
{
"status": "affected",
"version": "4.x"
}
]
},
{
"vendor": "GL.iNet",
"modules": [
"Download Interface"
],
"product": "GL-AX1800 Flint",
"versions": [
{
"status": "affected",
"version": "4.x"
}
]
},
{
"vendor": "GL.iNet",
"modules": [
"Download Interface"
],
"product": "GL-AXT1800 Slate AX",
"versions": [
{
"status": "affected",
"version": "4.x"
}
]
},
{
"vendor": "GL.iNet",
"modules": [
"Download Interface"
],
"product": "GL-B1300 Convexa-B",
"versions": [
{
"status": "affected",
"version": "4.x"
}
]
},
{
"vendor": "GL.iNet",
"modules": [
"Download Interface"
],
"product": "GL-B3000 Marble",
"versions": [
{
"status": "affected",
"version": "4.x"
}
]
},
{
"vendor": "GL.iNet",
"modules": [
"Download Interface"
],
"product": "GL-BE3600 Slate 7",
"versions": [
{
"status": "affected",
"version": "4.x"
}
]
},
{
"vendor": "GL.iNet",
"modules": [
"Download Interface"
],
"product": "GL-E750",
"versions": [
{
"status": "affected",
"version": "4.x"
}
]
},
{
"vendor": "GL.iNet",
"modules": [
"Download Interface"
],
"product": "GL-E750V2 Mudi",
"versions": [
{
"status": "affected",
"version": "4.x"
}
]
},
{
"vendor": "GL.iNet",
"modules": [
"Download Interface"
],
"product": "GL-MT300N-V2 Mango",
"versions": [
{
"status": "affected",
"version": "4.x"
}
]
},
{
"vendor": "GL.iNet",
"modules": [
"Download Interface"
],
"product": "GL-MT1300 Beryl",
"versions": [
{
"status": "affected",
"version": "4.x"
}
]
},
{
"vendor": "GL.iNet",
"modules": [
"Download Interface"
],
"product": "GL-MT2500 Brume 2",
"versions": [
{
"status": "affected",
"version": "4.x"
}
]
},
{
"vendor": "GL.iNet",
"modules": [
"Download Interface"
],
"product": "GL-MT3000 Beryl AX",
"versions": [
{
"status": "affected",
"version": "4.x"
}
]
},
{
"vendor": "GL.iNet",
"modules": [
"Download Interface"
],
"product": "GL-MT6000 Flint 2",
"versions": [
{
"status": "affected",
"version": "4.x"
}
]
},
{
"vendor": "GL.iNet",
"modules": [
"Download Interface"
],
"product": "GL-SFT1200 Opal",
"versions": [
{
"status": "affected",
"version": "4.x"
}
]
},
{
"vendor": "GL.iNet",
"modules": [
"Download Interface"
],
"product": "GL-X300B Collie",
"versions": [
{
"status": "affected",
"version": "4.x"
}
]
},
{
"vendor": "GL.iNet",
"modules": [
"Download Interface"
],
"product": "GL-X750 Spitz",
"versions": [
{
"status": "affected",
"version": "4.x"
}
]
},
{
"vendor": "GL.iNet",
"modules": [
"Download Interface"
],
"product": "GL-X3000 Spitz AX",
"versions": [
{
"status": "affected",
"version": "4.x"
}
]
},
{
"vendor": "GL.iNet",
"modules": [
"Download Interface"
],
"product": "GL-XE300 Puli",
"versions": [
{
"status": "affected",
"version": "4.x"
}
]
},
{
"vendor": "GL.iNet",
"modules": [
"Download Interface"
],
"product": "GL-XE3000 Puli AX",
"versions": [
{
"status": "affected",
"version": "4.x"
}
]
}
]
}
],
"published": "2025-04-26T08:15:14.500",
"references": [
{
"url": "https://vuldb.com/?ctiid.306287",
"source": "cna@vuldb.com"
},
{
"url": "https://vuldb.com/?id.306287",
"source": "cna@vuldb.com"
},
{
"url": "https://www.gl-inet.com/security-updates/security-advisories-vulnerabilities-and-cves-apr-24-2025/",
"source": "cna@vuldb.com"
}
],
"vulnStatus": "Deferred",
"weaknesses": [
{
"type": "Secondary",
"source": "cna@vuldb.com",
"description": [
{
"lang": "en",
"value": "CWE-266"
},
{
"lang": "en",
"value": "CWE-285"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "A vulnerability was found in GL.iNet GL-A1300 Slate Plus, GL-AR300M16 Shadow, GL-AR300M Shadow, GL-AR750 Creta, GL-AR750S-EXT Slate, GL-AX1800 Flint, GL-AXT1800 Slate AX, GL-B1300 Convexa-B, GL-B3000 Marble, GL-BE3600 Slate 7, GL-E750, GL-E750V2 Mudi, GL-MT300N-V2 Mango, GL-MT1300 Beryl, GL-MT2500 Brume 2, GL-MT3000 Beryl AX, GL-MT6000 Flint 2, GL-SFT1200 Opal, GL-X300B Collie, GL-X750 Spitz, GL-X3000 Spitz AX, GL-XE300 Puli and GL-XE3000 Puli AX 4.x. It has been rated as problematic. This issue affects some unknown processing of the component Download Interface. The manipulation leads to improper authorization. It is recommended to upgrade the affected component."
},
{
"lang": "es",
"value": "Se encontró una vulnerabilidad en GL.iNet GL-A1300 Slate Plus, GL-AR300M16 Shadow, GL-AR300M Shadow, GL-AR750 Creta, GL-AR750S-EXT Slate, GL-AX1800 Flint, GL-AXT1800 Slate AX, GL-B1300 Convexa-B, GL-B3000 Marble, GL-BE3600 Slate 7, GL-E750, GL-E750V2 Mudi, GL-MT300N-V2 Mango, GL-MT1300 Beryl, GL-MT2500 Brume 2, GL-MT3000 Beryl AX, GL-MT6000 Flint 2, GL-SFT1200 Opal, GL-X300B Collie, GL-X750 Spitz, GL-X3000 Spitz AX. GL-XE300 Puli y GL-XE3000 Puli AX 4.x. Se ha clasificado como problemático. Este problema afecta a un procesamiento desconocido del componente Interfaz de Descarga. Esta manipulación provoca una autorización incorrecta. Se recomienda actualizar el componente afectado."
}
],
"lastModified": "2026-06-17T09:07:43.790",
"sourceIdentifier": "cna@vuldb.com"
}