Gl-inet Gl-mt3000
23 CVEs affecting Gl-inet Gl-mt3000. Latest disclosed: 2026-08-03. Critical: 10, High: 10.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-18616 | Critical | 9.8 | 2026-08-03 | A vulnerability was identified in GL-iNet GL-MT3000 up to 4.4.5. The impacted element is the function server.set_peer of the file /cgi-bin/glc of the component… |
CVE-2026-18615 | Critical | 9.8 | 2026-08-03 | A vulnerability was determined in GL-iNet GL-MT3000 up to 4.4.5. The affected element is the function wg-server.generate_publickey of the file /cgi-bin/glc of… |
CVE-2026-18614 | Critical | 9.8 | 2026-08-03 | A vulnerability was found in GL-iNet GL-MT3000 up to 4.4.5. Impacted is the function s2s.enable_echo_server of the file /cgi-bin/glc of the component s2s.so Na… |
CVE-2026-18613 | Critical | 9.8 | 2026-08-03 | A vulnerability has been found in GL-iNet GL-MT3000 up to 4.4.5. This issue affects the function plugins.set_config of the file /cgi-bin/glc of the component p… |
CVE-2026-18612 | Critical | 9.8 | 2026-08-03 | A flaw has been found in GL-iNet GL-MT3000 up to 4.4.5. This vulnerability affects the function plugins.remove_package/plugins.install_package of the file /cgi… |
CVE-2023-50919 | Critical | 9.8 | 2024-01-12 | An issue was discovered on GL.iNet devices before version 4.5.0. There is an NGINX authentication bypass via Lua string pattern matching. This affects A1300 4… |
CVE-2023-50921 | Critical | 9.8 | 2024-01-03 | An issue was discovered on GL.iNet devices through 4.5.0. Attackers can invoke the add_user interface in the system module to gain root privileges. This affect… |
CVE-2023-31475 | Critical | 9.8 | 2023-05-11 | An issue was discovered on GL.iNet devices before 3.216. The function guci2_get() found in libglutil.so has a buffer overflow when an item is requested from a… |
CVE-2023-31471 | Critical | 9.8 | 2023-05-10 | An issue was discovered on GL.iNet devices before 3.216. Through the software installation feature, it is possible to install arbitrary software, such as a rev… |
CVE-2023-29778 | Critical | 9.8 | 2023-05-02 | GL.iNET MT3000 4.1.0 Release 2 is vulnerable to OS Command Injection via /usr/lib/oui-httpd/rpc/logread. |
CVE-2024-45263 | High | 8.8 | 2024-10-24 | An issue was discovered on certain GL-iNet devices, including MT6000, MT3000, MT2500, AXT1800, and AX1800 4.6.2. The upload interface allows the uploading of a… |
CVE-2024-45262 | High | 8.8 | 2024-10-24 | An issue was discovered on certain GL-iNet devices, including MT6000, MT3000, MT2500, AXT1800, and AX1800 4.6.2. The params parameter in the call method of the… |
CVE-2024-45261 | High | 8.0 | 2024-10-24 | An issue was discovered on certain GL-iNet devices, including MT6000, MT3000, MT2500, AXT1800, and AX1800 4.6.2. The SID generated for a specific user is not t… |
CVE-2024-45260 | High | 8.0 | 2024-10-24 | An issue was discovered on certain GL-iNet devices, including MT6000, MT3000, MT2500, AXT1800, and AX1800 4.6.2. Users who belong to unauthorized groups can in… |
CVE-2023-50445 | High | 7.8 | 2023-12-28 | Shell Injection vulnerability GL.iNet A1300 v4.4.6, AX1800 v4.4.6, AXT1800 v4.4.6, MT3000 v4.4.6, MT2500 v4.4.6, MT6000 v4.5.0, MT1300 v4.3.7, MT300N-V2 v4.3.7… |
CVE-2023-31477 | High | 7.5 | 2023-05-11 | A path traversal issue was discovered on GL.iNet devices before 3.216. Through the file sharing feature, it is possible to share an arbitrary directory, such a… |
CVE-2023-31478 | High | 7.5 | 2023-05-09 | An issue was discovered on GL.iNet devices before 3.216. An API endpoint reveals information about the Wi-Fi configuration, including the SSID and key. |
CVE-2023-31474 | High | 7.5 | 2023-05-09 | An issue was discovered on GL.iNet devices before 3.216. Through the software installation feature, it is possible to inject arbitrary parameters in a request… |
CVE-2023-31472 | High | 7.5 | 2023-05-09 | An issue was discovered on GL.iNet devices before 3.216. There is an arbitrary file write in which an empty file can be created anywhere on the filesystem. Thi… |
CVE-2023-50922 | High | 7.2 | 2024-01-03 | An issue was discovered on GL.iNet devices through 4.5.0. Attackers who are able to steal the AdminToken cookie can execute arbitrary code by uploading a cront… |