CVE-2024-28077: Gl-Inet a1300 Firmware

High severity, CVSS 7.5. EPSS: 0.4% chance of exploitation in the next 30 days.

A denial-of-service issue was discovered on certain GL-iNet devices. Some websites can detect devices exposed to the external network through DDNS, and consequently obtain the IP addresses and ports of devices that are exposed. By using special usernames and special characters (such as half parentheses or square brackets), one can call the login interface and cause the session-management program to crash, resulting in customers being unable to log into their devices. This affects MT6000 4.5.6, XE3000 4.4.5, X3000 4.4.6, MT3000 4.5.0, MT2500 4.5.0, AXT1800 4.5.0, AX1800 4.5.0, A1300 4.5.0, S200 4.1.4-0300, X750 4.3.7, SFT1200 4.3.7, MT1300 4.3.10, AR750 4.3.10, AR750S 4.3.10, AR300M 4.3.10, AR300M16 4.3.10, B1300 4.3.10, MT300N-V2 4.3.10, and XE300 4.3.16.

Affected products

• Gl-Inet a1300 Firmware: version 4.5.0 only
• Gl-Inet AR300M16 Firmware: version 4.3.10 only
• Gl-Inet AR300M Firmware: version 4.3.10 only
• Gl-Inet AR750 Firmware: version 4.3.10 only
• Gl-Inet AR750S Firmware: version 4.3.10 only
• Gl-Inet AX1800 Firmware: version 4.5.0 only
• Gl-Inet AXT1800 Firmware: version 4.5.0 only
• Gl-Inet b1300 Firmware: version 4.3.10 only
• Gl-Inet MT1300 Firmware: version 4.3.10 only
• Gl-Inet MT2500 Firmware: version 4.5.0 only
• Gl-Inet MT3000 Firmware: version 4.5.0 only
• Gl-Inet MT300N-v2 Firmware: version 4.3.10 only
• Gl-Inet MT6000 Firmware: version 4.5.6 only
• Gl-Inet SFT1200 Firmware: version 4.3.7 only
• Gl-Inet x3000 Firmware: version 4.4.6 only
• Gl-Inet x750 Firmware: version 4.3.7 only
• Gl-Inet XE3000 Firmware: version 4.4.4 only
• Gl-Inet XE300 Firmware: version 4.3.16 only

Published 2024-08-26. Last modified 2026-06-17.