{
    "id": "CVE-2024-27356",
    "published": "2024-02-27 01:15:07",
    "last_modified": "2026-06-17 07:19:43",
    "cvss_score": "7.5",
    "cvss_severity": "HIGH",
    "cvss_version": "3.1",
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
    "cwe": "CWE-200",
    "description": "An issue was discovered on certain GL-iNet devices. Attackers can download files such as logs via commands, potentially obtaining critical user information. This affects MT6000 4.5.5, XE3000 4.4.4, X3000 4.4.5, MT3000 4.5.0, MT2500 4.5.0, AXT1800 4.5.0, AX1800 4.5.0, A1300 4.5.0, S200 4.1.4-0300, X750 4.3.7, SFT1200 4.3.7, XE300 4.3.7, MT1300 4.3.10, AR750 4.3.10, AR750S 4.3.10, AR300M 4.3.10, AR300M16 4.3.10, B1300 4.3.10, MT300N-v2 4.3.10, X300B 3.217, S1300 3.216, SF1200 3.216, MV1000 3.216, N300 3.216, B2200 3.216, and X1200 3.203.",
    "epss_score": "0.23905",
    "epss_percentile": "0.97761",
    "kev": 0,
    "kev_due": null,
    "has_exploit": 1,
    "updated_at": "2026-09-29 18:17:40",
    "priority": {
        "rank": 2,
        "label": "Patch early",
        "why": "A public exploit exists."
    },
    "products": [
        {
            "vendor": "gl-inet",
            "product": "a1300"
        },
        {
            "vendor": "gl-inet",
            "product": "a1300_firmware"
        },
        {
            "vendor": "gl-inet",
            "product": "ar300m"
        },
        {
            "vendor": "gl-inet",
            "product": "ar300m_firmware"
        },
        {
            "vendor": "gl-inet",
            "product": "ar300m16"
        },
        {
            "vendor": "gl-inet",
            "product": "ar300m16_firmware"
        },
        {
            "vendor": "gl-inet",
            "product": "ar750"
        },
        {
            "vendor": "gl-inet",
            "product": "ar750_firmware"
        },
        {
            "vendor": "gl-inet",
            "product": "ar750s"
        },
        {
            "vendor": "gl-inet",
            "product": "ar750s_firmware"
        },
        {
            "vendor": "gl-inet",
            "product": "ax1800"
        },
        {
            "vendor": "gl-inet",
            "product": "ax1800_firmware"
        },
        {
            "vendor": "gl-inet",
            "product": "axt1800"
        },
        {
            "vendor": "gl-inet",
            "product": "axt1800_firmware"
        },
        {
            "vendor": "gl-inet",
            "product": "b1300"
        },
        {
            "vendor": "gl-inet",
            "product": "b1300_firmware"
        },
        {
            "vendor": "gl-inet",
            "product": "mt1300"
        },
        {
            "vendor": "gl-inet",
            "product": "mt1300_firmware"
        },
        {
            "vendor": "gl-inet",
            "product": "mt2500"
        },
        {
            "vendor": "gl-inet",
            "product": "mt2500_firmware"
        },
        {
            "vendor": "gl-inet",
            "product": "mt3000"
        },
        {
            "vendor": "gl-inet",
            "product": "mt3000_firmware"
        },
        {
            "vendor": "gl-inet",
            "product": "mt300n-v2"
        },
        {
            "vendor": "gl-inet",
            "product": "mt300n-v2_firmware"
        },
        {
            "vendor": "gl-inet",
            "product": "mt6000"
        },
        {
            "vendor": "gl-inet",
            "product": "mt6000_firmware"
        },
        {
            "vendor": "gl-inet",
            "product": "s200"
        },
        {
            "vendor": "gl-inet",
            "product": "s200_firmware"
        },
        {
            "vendor": "gl-inet",
            "product": "sft1200"
        },
        {
            "vendor": "gl-inet",
            "product": "sft1200_firmware"
        },
        {
            "vendor": "gl-inet",
            "product": "x3000"
        },
        {
            "vendor": "gl-inet",
            "product": "x3000_firmware"
        },
        {
            "vendor": "gl-inet",
            "product": "x300b"
        },
        {
            "vendor": "gl-inet",
            "product": "x300b_firmware"
        },
        {
            "vendor": "gl-inet",
            "product": "x750"
        },
        {
            "vendor": "gl-inet",
            "product": "x750_firmware"
        },
        {
            "vendor": "gl-inet",
            "product": "xe300"
        },
        {
            "vendor": "gl-inet",
            "product": "xe300_firmware"
        },
        {
            "vendor": "gl-inet",
            "product": "xe3000"
        },
        {
            "vendor": "gl-inet",
            "product": "xe3000_firmware"
        }
    ],
    "kev_detail": null,
    "exploits": [
        {
            "source": "exploit-db",
            "ref_id": "51942",
            "title": "GL-iNet MT6000 4.5.5 - Arbitrary File Download",
            "date": "2024-04-02",
            "url": "https://www.exploit-db.com/exploits/51942"
        }
    ],
    "refs_list": [
        "https://github.com/gl-inet/CVE-issues/blob/main/4.0.0/Download_file_vulnerability.md",
        "https://gl-inet.com",
        "https://github.com/gl-inet/CVE-issues/blob/main/4.0.0/Download_file_vulnerability.md",
        "https://gl-inet.com"
    ]
}