Gl-Inet MT3000 Firmware vulnerabilities

12 CVEs affecting Gl-Inet MT3000 Firmware, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2024-45263, published 2024-10-24.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2024-27356, published 2024-02-27. High severity, CVSS 7.5. EPSS: 23.9% chance of exploitation in the next 30 days. An issue was discovered on certain GL-iNet devices. Attackers can download files such as logs via commands, potentially obtaining critical user information. This affects MT6000 4.5.5, XE3000 4.4.4,…
CVE-2024-39226, published 2024-08-06. Critical severity, CVSS 9.8. EPSS: 20.4% chance of exploitation in the next 30 days. GL-iNet products AR750/AR750S/AR300M/AR300M16/MT300N-V2/B1300/MT1300/SFT1200/X750 v4.3.11, MT3000/MT2500/AXT1800/AX1800/A1300/X300B v4.5.16, XE300 v4.3.16, E750 v4.3.12, AP1300/S1300 v4.3.13, and…
CVE-2024-39225, published 2024-08-06. Critical severity, CVSS 9.8. EPSS: 14.4% chance of exploitation in the next 30 days. GL-iNet products AR750/AR750S/AR300M/AR300M16/MT300N-V2/B1300/MT1300/SFT1200/X750 v4.3.11, MT3000/MT2500/AXT1800/AX1800/A1300/X300B v4.5.16, XE300 v4.3.16, E750 v4.3.12, AP1300/S1300 v4.3.13, and…
CVE-2024-45260, published 2024-10-24. High severity, CVSS 8.0. EPSS: 4.1% chance of exploitation in the next 30 days. An issue was discovered on certain GL-iNet devices, including MT6000, MT3000, MT2500, AXT1800, and AX1800 4.6.2. Users who belong to unauthorized groups can invoke any interface of the device,…
CVE-2024-39227, published 2024-08-06. Critical severity, CVSS 9.8. EPSS: 1.2% chance of exploitation in the next 30 days. GL-iNet products AR750/AR750S/AR300M/AR300M16/MT300N-V2/B1300/MT1300/SFT1200/X750 v4.3.11, MT3000/MT2500/AXT1800/AX1800/A1300/X300B v4.5.16, XE300 v4.3.16, E750 v4.3.12, AP1300/S1300 v4.3.13, and…
CVE-2024-45262, published 2024-10-24. High severity, CVSS 8.8. EPSS: 0.7% chance of exploitation in the next 30 days. An issue was discovered on certain GL-iNet devices, including MT6000, MT3000, MT2500, AXT1800, and AX1800 4.6.2. The params parameter in the call method of the /rpc endpoint is vulnerable to…
CVE-2024-39228, published 2024-08-06. Critical severity, CVSS 9.8. EPSS: 0.7% chance of exploitation in the next 30 days. GL-iNet products AR750/AR750S/AR300M/AR300M16/MT300N-V2/B1300/MT1300/SFT1200/X750 v4.3.11, MT3000/MT2500/AXT1800/AX1800/A1300/X300B v4.5.16, XE300 v4.3.16, E750 v4.3.12, AP1300/S1300 v4.3.13, and…
CVE-2024-45261, published 2024-10-24. High severity, CVSS 8.0. EPSS: 0.5% chance of exploitation in the next 30 days. An issue was discovered on certain GL-iNet devices, including MT6000, MT3000, MT2500, AXT1800, and AX1800 4.6.2. The SID generated for a specific user is not tied to that user itself, which allows…
CVE-2024-28077, published 2024-08-26. High severity, CVSS 7.5. EPSS: 0.4% chance of exploitation in the next 30 days. A denial-of-service issue was discovered on certain GL-iNet devices. Some websites can detect devices exposed to the external network through DDNS, and consequently obtain the IP addresses and ports…
CVE-2024-45263, published 2024-10-24. High severity, CVSS 8.8. EPSS: 0.3% chance of exploitation in the next 30 days. An issue was discovered on certain GL-iNet devices, including MT6000, MT3000, MT2500, AXT1800, and AX1800 4.6.2. The upload interface allows the uploading of arbitrary files to the device. Once the…

Latest

CVE-2024-45259, published 2024-10-24. Medium severity, CVSS 6.5. EPSS: 0.2% chance of exploitation in the next 30 days. An issue was discovered on certain GL-iNet devices, including MT6000, MT3000, MT2500, AXT1800, and AX1800 4.6.2. By intercepting an HTTP request and changing the filename property in the download…
CVE-2024-39229, published 2024-08-06. Medium severity, CVSS 5.3. EPSS: 0.2% chance of exploitation in the next 30 days. An issue in GL-iNet products AR750/AR750S/AR300M/AR300M16/MT300N-V2/B1300/MT1300/SFT1200/X750 v4.3.11, MT3000/MT2500/AXT1800/AX1800/A1300/X300B v4.5.16, XE300 v4.3.16, E750 v4.3.12, AP1300/S1300…