{"id":"CVE-2024-39227","aliases":["EUVD-2024-37873","GHSA-8j3m-968h-m85q"],"status":"published","title":"GL-iNet products AR750/AR750S/AR300M/AR300M16/MT300N-V2/B1300/MT1300/SFT1200/X750 v4.3.11, MT3000...","description":"GL-iNet products AR750/AR750S/AR300M/AR300M16/MT300N-V2/B1300/MT1300/SFT1200/X750 v4.3.11, MT3000/MT2500/AXT1800/AX1800/A1300/X300B v4.5.16, XE300 v4.3.16, E750 v4.3.12, AP1300/S1300 v4.3.13, and XE3000/X3000 v4.4 were discovered to contain insecure permissions in the endpoint /cgi-bin/glc. This vulnerability allows unauthenticated attackers to execute arbitrary code or possibly a directory traversal via crafted JSON data.","severity":{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-11","score":0.01191,"percentile":0.68374,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-74","CWE-75"],"published":"2024-08-06T00:00:00Z","modified":"2026-06-17T07:41:33Z","products":[{"vendor":"gl-inet","product":"a1300_firmware"},{"vendor":"gl-inet","product":"ap1300_firmware"},{"vendor":"gl-inet","product":"ar300m16_firmware"},{"vendor":"gl-inet","product":"ar300m_firmware"},{"vendor":"gl-inet","product":"ar750_firmware"},{"vendor":"gl-inet","product":"ar750s_firmware"},{"vendor":"gl-inet","product":"ax1800_firmware"},{"vendor":"gl-inet","product":"axt1800_firmware"},{"vendor":"gl-inet","product":"b1300_firmware"},{"vendor":"gl-inet","product":"b2200_firmware"},{"vendor":"gl-inet","product":"e750_firmware"},{"vendor":"gl-inet","product":"gl-a1300"},{"vendor":"gl-inet","product":"gl-ap1300"},{"vendor":"gl-inet","product":"gl-ar300m"},{"vendor":"gl-inet","product":"gl-ar300m16"},{"vendor":"gl-inet","product":"gl-ar300n-v2"},{"vendor":"gl-inet","product":"gl-ar750"},{"vendor":"gl-inet","product":"gl-ar750s"},{"vendor":"gl-inet","product":"gl-ax1800"},{"vendor":"gl-inet","product":"gl-axt1800"},{"vendor":"gl-inet","product":"gl-b1300"},{"vendor":"gl-inet","product":"gl-e750"},{"vendor":"gl-inet","product":"gl-mt1300"},{"vendor":"gl-inet","product":"gl-mt2500"},{"vendor":"gl-inet","product":"gl-mt3000"},{"vendor":"gl-inet","product":"gl-s1300"},{"vendor":"gl-inet","product":"gl-sft1200"},{"vendor":"gl-inet","product":"gl-x3000"},{"vendor":"gl-inet","product":"gl-x300b"},{"vendor":"gl-inet","product":"gl-x750"},{"vendor":"gl-inet","product":"gl-xe300"},{"vendor":"gl-inet","product":"gl-xe3000"},{"vendor":"gl-inet","product":"mt1300_firmware"},{"vendor":"gl-inet","product":"mt2500_firmware"},{"vendor":"gl-inet","product":"mt3000_firmware"},{"vendor":"gl-inet","product":"mt300n-v2_firmware"},{"vendor":"gl-inet","product":"mt6000_firmware"},{"vendor":"gl-inet","product":"mv1000_firmware"},{"vendor":"gl-inet","product":"mv1000w_firmware"},{"vendor":"gl-inet","product":"n300_firmware"},{"vendor":"gl-inet","product":"s1300_firmware"},{"vendor":"gl-inet","product":"sf1200_firmware"},{"vendor":"gl-inet","product":"sft1200_firmware"},{"vendor":"gl-inet","product":"usb150_firmware"},{"vendor":"gl-inet","product":"x3000_firmware"},{"vendor":"gl-inet","product":"x300b_firmware"},{"vendor":"gl-inet","product":"x750_firmware"},{"vendor":"gl-inet","product":"xe3000_firmware"},{"vendor":"gl-inet","product":"xe300_firmware"}],"references":[{"url":"https://github.com/gl-inet/CVE-issues/blob/main/4.0.0/Access%20to%20the%20C%20library%20without%20logging%20in.md","tags":["Exploit","Third Party Advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-39227"},{"url":"http://ar750ar750sar300mar300m16mt300n-v2b1300mt1300sft1200x750.com"},{"url":"https://github.com/advisories/GHSA-8j3m-968h-m85q"}],"sources":{"cve":[{"id":"CVE-2024-39227","description":"GL-iNet products AR750/AR750S/AR300M/AR300M16/MT300N-V2/B1300/MT1300/SFT1200/X750 v4.3.11, MT3000/MT2500/AXT1800/AX1800/A1300/X300B v4.5.16, XE300 v4.3.16, E750 v4.3.12, AP1300/S1300 v4.3.13, and XE3000/X3000 v4.4 were discovered to contain insecure permissions in the endpoint /cgi-bin/glc. This vulnerability allows unauthenticated attackers to execute arbitrary code or possibly a directory traversal via crafted JSON data.","status":"published","published":"2024-08-06T00:00:00Z","modified":"2024-08-15T15:40:35.188Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"adp"}],"cwes":["CWE-75"],"updated_at":"2026-11-02T14:34:18.951288Z"}],"euvd":[{"id":"EUVD-2024-37873","description":"GL-iNet products AR750/AR750S/AR300M/AR300M16/MT300N-V2/B1300/MT1300/SFT1200/X750 v4.3.11, MT3000/MT2500/AXT1800/AX1800/A1300/X300B v4.5.16, XE300 v4.3.16, E750 v4.3.12, AP1300/S1300 v4.3.13, and XE3000/X3000 v4.4 were discovered to contain insecure permissions in the endpoint /cgi-bin/glc. This vulnerability allows unauthenticated attackers to execute arbitrary code or possibly a directory traversal via crafted JSON data.","status":"published","published":"2024-08-06T00:00:00Z","modified":"2024-08-15T15:40:35Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-03T00:56:17.186492Z"}],"ghsa":[{"id":"GHSA-8j3m-968h-m85q","title":"GL-iNet products AR750/AR750S/AR300M/AR300M16/MT300N-V2/B1300/MT1300/SFT1200/X750 v4.3.11, MT3000...","description":"GL-iNet products AR750/AR750S/AR300M/AR300M16/MT300N-V2/B1300/MT1300/SFT1200/X750 v4.3.11, MT3000/MT2500/AXT1800/AX1800/A1300/X300B v4.5.16, XE300 v4.3.16, E750 v4.3.12, AP1300/S1300 v4.3.13, and XE3000/X3000 v4.4 were discovered to contain a shell injection vulnerability via the interface check_ovpn_client_config.","status":"published","published":"2024-08-06T18:30:57Z","modified":"2024-08-12T21:32:35Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-74","CWE-75"],"updated_at":"2026-11-02T14:57:55.768435Z"}],"nvd":[{"id":"CVE-2024-39227","description":"GL-iNet products AR750/AR750S/AR300M/AR300M16/MT300N-V2/B1300/MT1300/SFT1200/X750 v4.3.11, MT3000/MT2500/AXT1800/AX1800/A1300/X300B v4.5.16, XE300 v4.3.16, E750 v4.3.12, AP1300/S1300 v4.3.13, and XE3000/X3000 v4.4 were discovered to contain insecure permissions in the endpoint /cgi-bin/glc. This vulnerability allows unauthenticated attackers to execute arbitrary code or possibly a directory traversal via crafted JSON data.","status":"published","published":"2024-08-06T17:15:53.943Z","modified":"2026-06-17T07:41:33.27Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary"},{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"secondary"}],"cwes":["CWE-74","CWE-75"],"updated_at":"2026-11-02T14:10:17.832118Z"}]}}