Gl-Inet b3000 Firmware vulnerabilities

5 CVEs affecting Gl-Inet b3000 Firmware, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2024-45263, published 2024-10-24.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2024-45260, published 2024-10-24. High severity, CVSS 8.0. EPSS: 4.1% chance of exploitation in the next 30 days. An issue was discovered on certain GL-iNet devices, including MT6000, MT3000, MT2500, AXT1800, and AX1800 4.6.2. Users who belong to unauthorized groups can invoke any interface of the device,…
CVE-2024-45262, published 2024-10-24. High severity, CVSS 8.8. EPSS: 0.7% chance of exploitation in the next 30 days. An issue was discovered on certain GL-iNet devices, including MT6000, MT3000, MT2500, AXT1800, and AX1800 4.6.2. The params parameter in the call method of the /rpc endpoint is vulnerable to…
CVE-2024-45261, published 2024-10-24. High severity, CVSS 8.0. EPSS: 0.5% chance of exploitation in the next 30 days. An issue was discovered on certain GL-iNet devices, including MT6000, MT3000, MT2500, AXT1800, and AX1800 4.6.2. The SID generated for a specific user is not tied to that user itself, which allows…
CVE-2024-45263, published 2024-10-24. High severity, CVSS 8.8. EPSS: 0.3% chance of exploitation in the next 30 days. An issue was discovered on certain GL-iNet devices, including MT6000, MT3000, MT2500, AXT1800, and AX1800 4.6.2. The upload interface allows the uploading of arbitrary files to the device. Once the…
CVE-2024-45259, published 2024-10-24. Medium severity, CVSS 6.5. EPSS: 0.2% chance of exploitation in the next 30 days. An issue was discovered on certain GL-iNet devices, including MT6000, MT3000, MT2500, AXT1800, and AX1800 4.6.2. By intercepting an HTTP request and changing the filename property in the download…