CVSS 3.1
8.8 highCVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HCVE-2024-45262
An issue was discovered on certain GL-iNet devices, including MT6000, MT3000, MT2500, AXT1800, and AX1800 4.6.2. The params parameter in the call method of the /rpc endpoint is vulnerable to arbitrary directory traversal, which enables attackers to execute scripts under any path.
Severity
- EPSS
- 0.7% chance of exploitation in the next 30 days; higher than 51% of CVEs (scores of 2026-10-31)
- CWE
- CWE-22
- Published
- Modified
- Record from
- the NVD, synced
Affected
- gl-inet:a1300_firmware
- gl-inet:ar300m16_firmware
- gl-inet:ar300m_firmware
- gl-inet:ar750_firmware
- gl-inet:ar750s_firmware
- gl-inet:ax1800_firmware
- gl-inet:axt1800_firmware
- gl-inet:b1300_firmware
- gl-inet:b3000_firmware
- gl-inet:e750_firmware
- gl-inet:mt1300_firmware
- gl-inet:mt2500_firmware
- gl-inet:mt3000_firmware
- gl-inet:mt300n-v2_firmware
- gl-inet:mt6000_firmware
- gl-inet:sft1200_firmware
- gl-inet:x3000_firmware
- gl-inet:x300b_firmware
- gl-inet:x750_firmware
- gl-inet:xe3000_firmware
- gl-inet:xe300_firmware