CVE-2024-45261
HIGH 8.0EPSS 0.5%
An issue was discovered on certain GL-iNet devices, including MT6000, MT3000, MT2500, AXT1800, and AX1800 4.6.2. The SID generated for a specific user is not tied to that user itself, which allows other users to potentially use it for authentication. Once an attacker bypasses the application's authentication procedures, they can generate a valid SID, escalate privileges, and gain full control.
- CVSS v3.1
- 8.0 HIGH
CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - EPSS
- 0.49% chance of exploitation in the next 30 days, 40th percentile
- Published
- 2024-10-24
- Updated
- 2024-10-28
Proof-of-concept exploits (1)
- aggressor0/GL.iNet-Exploits1★ · 2024-10-29