CVE-2024-39227: инжекция

Описание

Оригинално описание

GL-iNet products AR750/AR750S/AR300M/AR300M16/MT300N-V2/B1300/MT1300/SFT1200/X750 v4.3.11, MT3000/MT2500/AXT1800/AX1800/A1300/X300B v4.5.16, XE300 v4.3.16, E750 v4.3.12, AP1300/S1300 v4.3.13, and XE3000/X3000 v4.4 were discovered to contain insecure permissions in the endpoint /cgi-bin/glc. This vulnerability allows unauthenticated attackers to execute arbitrary code or possibly a directory traversal via crafted JSON data.

Засегнати продукти

• n/a n/a: n/a
• gl-inet: още 21 продукта, добавени от gl-inet

  gl-mt2500, gl-axt1800, gl-ax1800, gl-a1300, gl-x300b, gl-xe300, gl-e750, gl-ap1300, gl-s1300, gl-xe3000, gl-x3000, gl-ar750, gl-ar750s, gl-ar300m, gl-ar300m16, gl-ar300n-v2, gl-b1300, gl-mt1300, gl-sft1200, gl-x750, gl-mt3000

Вид слабост

• CWE-75 Неуспешно саниране на специални елементи за друго контекстно ниво

История

Други уязвимости в n/a n/a

• 9.8CVE-2026-18616
• 9.8CVE-2026-18615
• 9.8CVE-2026-18614
• 9.8CVE-2026-18613
• 9.8CVE-2026-18612

Първоизточници

• https://www.cve.org/CVERecord?id=CVE-2024-39227
• https://nvd.nist.gov/vuln/detail/CVE-2024-39227
• https://github.com/gl-inet/CVE-issues/blob/main/4.0.0/Access%20to%20the%20C%20library%20without%20logging%20in.md