{"id":"CVE-2024-39226","aliases":["EUVD-2024-37872","GHSA-9qmq-f7gc-gf44"],"status":"published","title":"GL-iNet products AR750/AR750S/AR300M/AR300M16/MT300N-V2/B1300/MT1300/SFT1200/X750 v4.3.11, MT3000...","description":"GL-iNet products AR750/AR750S/AR300M/AR300M16/MT300N-V2/B1300/MT1300/SFT1200/X750 v4.3.11, MT3000/MT2500/AXT1800/AX1800/A1300/X300B v4.5.16, XE300 v4.3.16, E750 v4.3.12, AP1300/S1300 v4.3.13, and XE3000/X3000 v4.4 were discovered to contain a vulnerability can be exploited to manipulate routers by passing malicious shell commands through the s2s API.","severity":{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-12","score":0.20403,"percentile":0.97524,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-22","CWE-77"],"published":"2024-08-06T00:00:00Z","modified":"2026-06-17T07:41:33Z","products":[{"vendor":"gl-inet","product":"a1300_firmware"},{"vendor":"gl-inet","product":"ap1300_firmware"},{"vendor":"gl-inet","product":"ar300m16_firmware"},{"vendor":"gl-inet","product":"ar300m_firmware"},{"vendor":"gl-inet","product":"ar750_firmware"},{"vendor":"gl-inet","product":"ar750s_firmware"},{"vendor":"gl-inet","product":"ax1800_firmware"},{"vendor":"gl-inet","product":"axt1800_firmware"},{"vendor":"gl-inet","product":"b1300_firmware"},{"vendor":"gl-inet","product":"b2200_firmware"},{"vendor":"gl-inet","product":"e750_firmware"},{"vendor":"gl-inet","product":"mt1300_firmware"},{"vendor":"gl-inet","product":"mt2500_firmware"},{"vendor":"gl-inet","product":"mt3000_firmware"},{"vendor":"gl-inet","product":"mt300n-v2_firmware"},{"vendor":"gl-inet","product":"mt6000_firmware"},{"vendor":"gl-inet","product":"mv1000_firmware"},{"vendor":"gl-inet","product":"mv1000w_firmware"},{"vendor":"gl-inet","product":"n300_firmware"},{"vendor":"gl-inet","product":"s1300_firmware"},{"vendor":"gl-inet","product":"sf1200_firmware"},{"vendor":"gl-inet","product":"sft1200_firmware"},{"vendor":"gl-inet","product":"usb150_firmware"},{"vendor":"gl-inet","product":"x3000_firmware"},{"vendor":"gl-inet","product":"x300b_firmware"},{"vendor":"gl-inet","product":"x750_firmware"},{"vendor":"gl-inet","product":"xe3000_firmware"},{"vendor":"gl-inet","product":"xe300_firmware"}],"references":[{"url":"https://github.com/gl-inet/CVE-issues/blob/main/4.0.0/s2s%20interface%20shell%20injection.md","tags":["Exploit","Third Party Advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-39226"},{"url":"http://ar750ar750sar300mar300m16mt300n-v2b1300mt1300sft1200x750.com"},{"url":"https://github.com/advisories/GHSA-9qmq-f7gc-gf44"}],"sources":{"cve":[{"id":"CVE-2024-39226","description":"GL-iNet products AR750/AR750S/AR300M/AR300M16/MT300N-V2/B1300/MT1300/SFT1200/X750 v4.3.11, MT3000/MT2500/AXT1800/AX1800/A1300/X300B v4.5.16, XE300 v4.3.16, E750 v4.3.12, AP1300/S1300 v4.3.13, and XE3000/X3000 v4.4 were discovered to contain a vulnerability can be exploited to manipulate routers by passing malicious shell commands through the s2s API.","status":"published","published":"2024-08-06T00:00:00Z","modified":"2024-11-12T17:08:43.264Z","cvss":[{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"medium","assessor":"adp"}],"cwes":["CWE-77"],"updated_at":"2026-11-02T14:34:19.28149Z"}],"euvd":[{"id":"EUVD-2024-37872","description":"GL-iNet products AR750/AR750S/AR300M/AR300M16/MT300N-V2/B1300/MT1300/SFT1200/X750 v4.3.11, MT3000/MT2500/AXT1800/AX1800/A1300/X300B v4.5.16, XE300 v4.3.16, E750 v4.3.12, AP1300/S1300 v4.3.13, and XE3000/X3000 v4.4 were discovered to contain a vulnerability can be exploited to manipulate routers by passing malicious shell commands through the s2s API.","status":"published","published":"2024-08-06T00:00:00Z","modified":"2024-11-12T17:08:43Z","cvss":[{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"medium"}],"updated_at":"2026-11-03T00:05:03.88189Z"}],"ghsa":[{"id":"GHSA-9qmq-f7gc-gf44","title":"GL-iNet products AR750/AR750S/AR300M/AR300M16/MT300N-V2/B1300/MT1300/SFT1200/X750 v4.3.11, MT3000...","description":"GL-iNet products AR750/AR750S/AR300M/AR300M16/MT300N-V2/B1300/MT1300/SFT1200/X750 v4.3.11, MT3000/MT2500/AXT1800/AX1800/A1300/X300B v4.5.16, XE300 v4.3.16, E750 v4.3.12, AP1300/S1300 v4.3.13, and XE3000/X3000 v4.4 were discovered to contain insecure permissions in the endpoint /cgi-bin/glc. This vulnerability allows unauthenticated attackers to execute arbitrary code or possibly a directory traversal via crafted JSON data.","status":"published","published":"2024-08-06T18:30:56Z","modified":"2024-11-12T18:30:51Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-22","CWE-77"],"updated_at":"2026-11-02T14:58:47.584935Z"}],"nvd":[{"id":"CVE-2024-39226","description":"GL-iNet products AR750/AR750S/AR300M/AR300M16/MT300N-V2/B1300/MT1300/SFT1200/X750 v4.3.11, MT3000/MT2500/AXT1800/AX1800/A1300/X300B v4.5.16, XE300 v4.3.16, E750 v4.3.12, AP1300/S1300 v4.3.13, and XE3000/X3000 v4.4 were discovered to contain a vulnerability can be exploited to manipulate routers by passing malicious shell commands through the s2s API.","status":"published","published":"2024-08-06T16:15:48.757Z","modified":"2026-06-17T07:41:33.073Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary"},{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"medium","assessor":"secondary"}],"cwes":["CWE-22","CWE-77"],"updated_at":"2026-11-02T14:10:17.832118Z"}]}}