gl-inet gl-ar300m firmware 4.3.7 vulnerabilities and exploits

(subscribe to this query)

An issue exists on GL.iNet devices before version 4.5.0. There is an NGINX authentication bypass via Lua string pattern matching. This affects A1300 4.4.6, AX1800 4.4.6, AXT1800 4.4.6, MT3000 4.4.6, MT2500 4.4.6, MT6000 4.5.0, MT1300 4.3.7, MT300N-V2 4.3.7, AR750S 4.3.7, AR750 4....

1 Metasploit module

An issue exists on GL.iNet devices before version 4.5.0. They assign the same session ID after each user reboot, allowing malicious users to share session identifiers between different sessions and bypass authentication or access control measures. Attackers can impersonate legiti...

An issue exists on GL.iNet devices up to and including 4.5.0. Attackers can invoke the add_user interface in the system module to gain root privileges. This affects A1300 4.4.6, AX1800 4.4.6, AXT1800 4.4.6, MT3000 4.4.6, MT2500 4.4.6, MT6000 4.5.0, MT1300 4.3.7, MT300N-V2 4.3.7, ...

Gl-inet Gl-mt1300 Firmware 4.3.7 Gl-inet Gl-mt300n-v2 Firmware 4.3.7 Gl-inet Gl-ar750s Firmware 4.3.7 Gl-inet Gl-ar750 Firmware 4.3.7 Gl-inet Gl-ar300m Firmware 4.3.7 Gl-inet Gl-b1300 Firmware 4.3.7 Gl-inet Gl-mt6000 Firmware 4.5.0 Gl-inet Gl-a1300 Firmware 4.4.6 Gl-inet Gl-ax1800 Firmware 4.4.6 Gl-inet Gl-axt1800 Firmware 4.4.6 Gl-inet Gl-mt3000 Firmware 4.4.6 Gl-inet Gl-mt2500 Firmware 4.4.6

An issue exists on GL.iNet devices up to and including 4.5.0. Attackers who are able to steal the AdminToken cookie can execute arbitrary code by uploading a crontab-formatted file to a specific directory and waiting for its execution. This affects A1300 4.4.6, AX1800 4.4.6, AXT1...

Gl-inet Gl-mt1300 Firmware 4.3.7 Gl-inet Gl-mt300n-v2 Firmware 4.3.7 Gl-inet Gl-ar750s Firmware 4.3.7 Gl-inet Gl-ar750 Firmware 4.3.7 Gl-inet Gl-ar300m Firmware 4.3.7 Gl-inet Gl-b1300 Firmware 4.3.7 Gl-inet Gl-mt6000 Firmware 4.5.0 Gl-inet Gl-a1300 Firmware 4.4.6 Gl-inet Gl-ax1800 Firmware 4.4.6 Gl-inet Gl-axt1800 Firmware 4.4.6 Gl-inet Gl-mt3000 Firmware 4.4.6 Gl-inet Gl-mt2500 Firmware 4.4.6

Shell Injection vulnerability GL.iNet A1300 v4.4.6, AX1800 v4.4.6, AXT1800 v4.4.6, MT3000 v4.4.6, MT2500 v4.4.6, MT6000 v4.5.0, MT1300 v4.3.7, MT300N-V2 v4.3.7, AR750S v4.3.7, AR750 v4.3.7, AR300M v4.3.7, and B1300 v4.3.7., allows local malicious users to execute arbitrary code v...

Gl-inet Gl-mt1300 Firmware 4.3.7 Gl-inet Gl-mt300n-v2 Firmware 4.3.7 Gl-inet Gl-ar750s Firmware 4.3.7 Gl-inet Gl-ar750 Firmware 4.3.7 Gl-inet Gl-ar300m Firmware 4.3.7 Gl-inet Gl-b1300 Firmware 4.3.7 Gl-inet Gl-mt6000 Firmware 4.5.0 Gl-inet Gl-a1300 Firmware 4.4.6 Gl-inet Gl-ax1800 Firmware 4.4.6 Gl-inet Gl-axt1800 Firmware 4.4.6 Gl-inet Gl-mt3000 Firmware 4.4.6 Gl-inet Gl-mt2500 Firmware 4.4.6

1 Metasploit module

In GL.iNET GL-AR300M routers with firmware v4.3.7, it is possible to inject arbitrary shell commands through a crafted package name in the package information functionality.

Gl-inet Gl-ar300m Firmware 4.3.7

1 Github repository

In GL.iNET GL-AR300M routers with firmware v4.3.7 it is possible to write arbitrary files through a path traversal attack in the OpenVPN client file upload functionality.

Gl-inet Gl-ar300m Firmware 4.3.7

1 Github repository

Vulmon Search is a vulnerability search engine. It gives comprehensive vulnerability information through a very simple user interface.

Home Recent Vulnerabilities Product List Vendor List Research Posts Trends Blog About Contact

Vulmon Search Vulmon Research Vulmon Alerts Vulmap

Twitter Reddit Linkedin Facebook