CVE-2024-45261: Gl-Inet a1300 Firmware

High severity, CVSS 8.0. EPSS: 0.5% chance of exploitation in the next 30 days.

An issue was discovered on certain GL-iNet devices, including MT6000, MT3000, MT2500, AXT1800, and AX1800 4.6.2. The SID generated for a specific user is not tied to that user itself, which allows other users to potentially use it for authentication. Once an attacker bypasses the application's authentication procedures, they can generate a valid SID, escalate privileges, and gain full control.

Affected products

• Gl-Inet a1300 Firmware: version 4.5.17 only
• Gl-Inet AR300M16 Firmware: version 4.3.17 only
• Gl-Inet AR300M Firmware: version 4.3.17 only
• Gl-Inet AR750 Firmware: version 4.3.17 only
• Gl-Inet AR750S Firmware: version 4.3.17 only
• Gl-Inet AX1800 Firmware: from 4.6.2, before 4.6.4 (fixed in 4.6.4)
• Gl-Inet AXT1800 Firmware: from 4.6.2, before 4.6.4 (fixed in 4.6.4)
• Gl-Inet b1300 Firmware: version 4.3.17 only
• Gl-Inet b3000 Firmware: version 4.5.18 only
• Gl-Inet e750 Firmware: version 4.3.17 only
• Gl-Inet MT1300 Firmware: version 4.3.18 only
• Gl-Inet MT2500 Firmware: from 4.6.2, before 4.6.4 (fixed in 4.6.4)
• Gl-Inet MT3000 Firmware: version 4.6.2 only
• Gl-Inet MT300N-v2 Firmware: version 4.3.17 only
• Gl-Inet MT6000 Firmware: version 4.6.2 only
• Gl-Inet SFT1200 Firmware: version 4.3.18 only
• Gl-Inet x3000 Firmware: version 4.4.9 only
• Gl-Inet x300b Firmware: version 4.5.17 only
• Gl-Inet x750 Firmware: version 4.3.18 only
• Gl-Inet XE3000 Firmware: version 4.4.9 only
• Gl-Inet XE300 Firmware: version 4.3.17 only

Published 2024-10-24. Last modified 2026-06-17.