Gl-Inet Gl-AR300M-Lite Firmware vulnerabilities

4 CVEs affecting Gl-Inet Gl-AR300M-Lite Firmware, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2019-6275, published 2019-03-21.

More from Gl-Inet.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

• CVE-2019-6275, published 2019-03-21. High severity, CVSS 8.8. EPSS: 12.5% chance of exploitation in the next 30 days. Command injection vulnerability in firmware_cgi in GL.iNet GL-AR300M-Lite devices with firmware 2.27 allows remote attackers to execute arbitrary code.
• CVE-2019-6272, published 2019-03-21. High severity, CVSS 8.8. EPSS: 12.5% chance of exploitation in the next 30 days. Command injection vulnerability in login_cgi in GL.iNet GL-AR300M-Lite devices with firmware 2.27 allows remote attackers to execute arbitrary code.
• CVE-2019-6273, published 2019-03-21. Medium severity, CVSS 6.5. EPSS: 11.5% chance of exploitation in the next 30 days. download_file in GL.iNet GL-AR300M-Lite devices with firmware 2.27 allows remote attackers to download arbitrary files.
• CVE-2019-6274, published 2019-03-21. High severity, CVSS 8.8. EPSS: 11.2% chance of exploitation in the next 30 days. Directory traversal vulnerability in storage_cgi in GL.iNet GL-AR300M-Lite devices with firmware 2.27 allows remote attackers to have unspecified impact via directory traversal sequences.