CVE-2024-45259
An issue was discovered on certain GL-iNet devices, including MT6000, MT3000, MT2500, AXT1800,...
An issue was discovered on certain GL-iNet devices, including MT6000, MT3000, MT2500, AXT1800, and AX1800 4.6.2. By intercepting an HTTP request and changing the filename property in the download interface, any file on the device can be deleted.
Attack profile
How easy it is to exploit
- Attack vector
- Adjacent network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- None
- Integrity
- High
- Availability
- None
Exploit likelihood
What each source reports
CVE List Score used
An issue was discovered on certain GL-iNet devices, including MT6000, MT3000, MT2500, AXT1800, and AX1800 4.6.2. By intercepting an HTTP request and changing the filename property in the download interface, any file on the device can be deleted.
- Record
CVE-2024-45259- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N - Weakness
- CWE-326
- Updated
- 2026-11-02
EUVDEUVD-2024-41395
An issue was discovered on certain GL-iNet devices, including MT6000, MT3000, MT2500, AXT1800, and AX1800 4.6.2. By intercepting an HTTP request and changing the filename property in the download interface, any file on the device can be deleted.
- Record
EUVD-2024-41395- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N - Updated
- 2026-11-03
GitHub AdvisoriesGHSA-g8q6-23x5-v2wf
An issue was discovered on certain GL-iNet devices, including MT6000, MT3000, MT2500, AXT1800,...
An issue was discovered on certain GL-iNet devices, including MT6000, MT3000, MT2500, AXT1800, and AX1800 4.6.2. By intercepting an HTTP request and changing the filename property in the download interface, any file on the device can be deleted.
- Record
GHSA-g8q6-23x5-v2wf- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N - Weakness
- CWE-326
- Updated
- 2026-11-02
NVD
An issue was discovered on certain GL-iNet devices, including MT6000, MT3000, MT2500, AXT1800, and AX1800 4.6.2. By intercepting an HTTP request and changing the filename property in the download interface, any file on the device can be deleted.
- Record
CVE-2024-45259- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N - Weakness
- CWE-326
- Updated
- 2026-11-02
Affected products
- gl-inet a1300 firmware
- gl-inet ar300m16 firmware
- gl-inet ar300m firmware
- gl-inet ar750 firmware
- gl-inet ar750s firmware
- gl-inet ax1800 firmware
- gl-inet axt1800 firmware
- gl-inet b1300 firmware
- gl-inet b3000 firmware
- gl-inet e750 firmware
- gl-inet gl-b3000 firmware
- gl-inet gl-mt6000 firmware
Show 14 moreShow less
- gl-inet gl-x300b firmware
- gl-inet gl-x750 firmware
- gl-inet gl-xe300 firmware
- gl-inet mt1300 firmware
- gl-inet mt2500 firmware
- gl-inet mt3000 firmware
- gl-inet mt300n-v2 firmware
- gl-inet mt6000 firmware
- gl-inet sft1200 firmware
- gl-inet x3000 firmware
- gl-inet x300b firmware
- gl-inet x750 firmware
- gl-inet xe3000 firmware
- gl-inet xe300 firmware
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2024-45259 is a medium vulnerability (CVSS 6.5) in Gl-inet A1300 Firmware, published October 24, 2024. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.23%, the 13th percentile. No source names a fixed version.