← Database

CVE-2024-45262

HIGH CVSS: 8.8 Published: 2024-10-24 Modified: 2026-06-17

Description

An issue was discovered on certain GL-iNet devices, including MT6000, MT3000, MT2500, AXT1800, and AX1800 4.6.2. The params parameter in the call method of the /rpc endpoint is vulnerable to arbitrary directory traversal, which enables attackers to execute scripts under any path.

Affected Platforms

Gl-Inet Mt300N-V2 FirmwareGl-Inet Ax1800Gl-Inet Mt2500Gl-Inet Ar750SGl-Inet Mt6000 FirmwareGl-Inet A1300Gl-Inet Xe3000 FirmwareGl-Inet X3000Gl-Inet Mt6000Gl-Inet Ar750

Weakness Type

CWE-22

References