peter bassill · operator
$ cve CVE-2024-39226 JSON

CVE-2024-39226

9.8
CRITICAL · CVSS 3.1 · EPSS 20.4% (pctl 97)

Patch early

EPSS 20.4% — above the 10% action threshold.

Description

GL-iNet products AR750/AR750S/AR300M/AR300M16/MT300N-V2/B1300/MT1300/SFT1200/X750 v4.3.11, MT3000/MT2500/AXT1800/AX1800/A1300/X300B v4.5.16, XE300 v4.3.16, E750 v4.3.12, AP1300/S1300 v4.3.13, and XE3000/X3000 v4.4 were discovered to contain a vulnerability can be exploited to manipulate routers by passing malicious shell commands through the s2s API.

Scoring

CVSS9.8 (CRITICAL, v3.1)
VectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS20.4% — more likely to be exploited than 97% of all CVEs
WeaknessCWE-22
On CISA KEVno
Public exploitnone known
Published2024-08-06
Last modified2026-06-17

Affected (40)

VendorProduct
gl-ineta1300
gl-ineta1300 firmware
gl-inetar300m
gl-inetar300m firmware
gl-inetar300m16
gl-inetar300m16 firmware
gl-inetar750
gl-inetar750 firmware
gl-inetar750s
gl-inetar750s firmware
gl-inetax1800
gl-inetax1800 firmware
gl-inetaxt1800
gl-inetaxt1800 firmware
gl-inetb1300
gl-inetb1300 firmware
gl-inete750
gl-inete750 firmware
gl-inetmt1300
gl-inetmt1300 firmware
gl-inetmt2500
gl-inetmt2500 firmware
gl-inetmt3000
gl-inetmt3000 firmware
gl-inetmt300n-v2
gl-inetmt300n-v2 firmware
gl-inetmt6000
gl-inetmt6000 firmware
gl-inetsft1200
gl-inetsft1200 firmware
gl-inetx3000
gl-inetx3000 firmware
gl-inetx300b
gl-inetx300b firmware
gl-inetx750
gl-inetx750 firmware
gl-inetxe300
gl-inetxe300 firmware
gl-inetxe3000
gl-inetxe3000 firmware

References

→ the Explorer  ·  watch your stack  ·  NVD