CVE-2024-45262: Gl-Inet a1300 Firmware

High severity, CVSS 8.8. EPSS: 0.7% chance of exploitation in the next 30 days.

An issue was discovered on certain GL-iNet devices, including MT6000, MT3000, MT2500, AXT1800, and AX1800 4.6.2. The params parameter in the call method of the /rpc endpoint is vulnerable to arbitrary directory traversal, which enables attackers to execute scripts under any path.

Affected products

• Gl-Inet a1300 Firmware: version 4.5.17 only
• Gl-Inet AR300M16 Firmware: version 4.3.17 only
• Gl-Inet AR300M Firmware: version 4.3.17 only
• Gl-Inet AR750 Firmware: version 4.3.17 only
• Gl-Inet AR750S Firmware: version 4.3.17 only
• Gl-Inet AX1800 Firmware: from 4.6.2, before 4.6.4 (fixed in 4.6.4)
• Gl-Inet AXT1800 Firmware: from 4.6.2, before 4.6.4 (fixed in 4.6.4)
• Gl-Inet b1300 Firmware: version 4.3.17 only
• Gl-Inet b3000 Firmware: version 4.5.18 only
• Gl-Inet e750 Firmware: version 4.3.17 only
• Gl-Inet MT1300 Firmware: version 4.3.18 only
• Gl-Inet MT2500 Firmware: from 4.6.2, before 4.6.4 (fixed in 4.6.4)
• Gl-Inet MT3000 Firmware: version 4.6.2 only
• Gl-Inet MT300N-v2 Firmware: version 4.3.17 only
• Gl-Inet MT6000 Firmware: version 4.6.2 only
• Gl-Inet SFT1200 Firmware: version 4.3.18 only
• Gl-Inet x3000 Firmware: version 4.4.9 only
• Gl-Inet x300b Firmware: version 4.5.17 only
• Gl-Inet x750 Firmware: version 4.3.18 only
• Gl-Inet XE3000 Firmware: version 4.4.9 only
• Gl-Inet XE300 Firmware: version 4.3.17 only

Published 2024-10-24. Last modified 2026-06-17.