Glinet

**Name of the Vulnerable Software and Affected Versions** GL.iNet A1300 versions 4.8.x GL.iNet AX1800 versions 4.8.x GL.iNet AXT1800 versions 4.8.x GL.iNet MT2500 versions 4.8.x GL.iNet MT3000 versions 4.8.x GL.iNet MT6000 versions 4.8.x GL.iNet X3000 versions 4.8.x GL.iNet XE3000 versions 4.8.x **Description** An OS command injection flaw exists in the NAS Command Service component due to improper processing of the `/usr/bin/gl nas sys` file. This issue allows a remote attacker to execute arbitrary operating system commands. **Recommendations** Upgrade GL.iNet A1300 to version 4.9.0. Upgrade GL.iNet AX1800 to version 4.9.0. Upgrade GL.iNet AXT1800 to version 4.9.0. Upgrade GL.iNet MT2500 to version 4.9.0. Upgrade GL.iNet MT3000 to version 4.9.0. Upgrade GL.iNet MT6000 to version 4.9.0. Upgrade GL.iNet X3000 to version 4.9.0. Upgrade GL.iNet XE3000 to version 4.9.0.

**Name of the Vulnerable Software and Affected Versions** GL.iNet A1300 versions prior to 4.9 GL.iNet AX1800 versions prior to 4.9 GL.iNet AXT1800 versions prior to 4.9 GL.iNet BE1400 versions prior to 4.9 GL.iNet BE3600 versions prior to 4.9 GL.iNet BE6500 versions prior to 4.9 GL.iNet BE9300 versions prior to 4.9 GL.iNet BE10000 versions prior to 4.9 GL.iNet E5800 versions prior to 4.9 GL.iNet MT2500 versions prior to 4.9 GL.iNet MT3000 versions prior to 4.9 GL.iNet MT3600BE versions prior to 4.9 GL.iNet MT5000 versions prior to 4.9 GL.iNet MT6000 versions prior to 4.9 GL.iNet X2000 versions prior to 4.9 GL.iNet X3000 versions prior to 4.9 GL.iNet XE3000 versions prior to 4.9 **Description** A remote authorization bypass exists within the WebDAV Service component. The issue occurs during the execution of the `COPY()` and `MOVE()` functions, allowing an attacker to bypass security restrictions remotely. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability. As a temporary workaround, consider restricting access to the WebDAV Service component to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** GL.iNet A1300 versions prior to 4.9 GL.iNet AX1800 versions prior to 4.9 GL.iNet AXT1800 versions prior to 4.9 GL.iNet BE1400 versions prior to 4.9 GL.iNet BE3600 versions prior to 4.9 GL.iNet BE6500 versions prior to 4.9 GL.iNet BE9300 versions prior to 4.9 GL.iNet BE10000 versions prior to 4.9 GL.iNet E5800 versions prior to 4.9 GL.iNet MT2500 versions prior to 4.9 GL.iNet MT3000 versions prior to 4.9 GL.iNet MT3600BE versions prior to 4.9 GL.iNet MT5000 versions prior to 4.9 GL.iNet MT6000 versions prior to 4.9 GL.iNet X2000 versions prior to 4.9 GL.iNet X3000 versions prior to 4.9 GL.iNet XE3000 versions prior to 4.9 **Description** A remote code injection flaw exists within the Language Update component. The issue occurs in the `ui.update langs()` function when the `hour`, `min`, or `week` arguments are manipulated, allowing an attacker to execute arbitrary code remotely. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability. As a temporary workaround, restrict access to the `ui.update langs()` function to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** GL.iNet A1300 versions prior to 4.8.x GL.iNet AX1800 versions prior to 4.8.x GL.iNet AXT1800 versions prior to 4.8.x GL.iNet BE1400 versions prior to 4.8.x GL.iNet BE3600 versions prior to 4.8.x GL.iNet BE6500 versions prior to 4.8.x GL.iNet BE9300 versions prior to 4.8.x GL.iNet BE10000 versions prior to 4.8.x GL.iNet E5800 versions prior to 4.8.x GL.iNet MT2500 versions prior to 4.8.x GL.iNet MT3000 versions prior to 4.8.x GL.iNet MT3600BE versions prior to 4.8.x GL.iNet MT5000 versions prior to 4.8.x GL.iNet MT6000 versions prior to 4.8.x GL.iNet X2000 versions prior to 4.8.x GL.iNet X3000 versions prior to 4.8.x GL.iNet XE3000 versions prior to 4.8.x **Description** A weakness in the Wi-Fi Timer Power-Schedule Feature allows for remote OS command injection. This occurs when the `switch power` or `restore power` arguments are manipulated. **Recommendations** Update GL.iNet A1300 to version 4.8.x or later. Update GL.iNet AX1800 to version 4.8.x or later. Update GL.iNet AXT1800 to version 4.8.x or later. Update GL.iNet BE1400 to version 4.8.x or later. Update GL.iNet BE3600 to version 4.8.x or later. Update GL.iNet BE6500 to version 4.8.x or later. Update GL.iNet BE9300 to version 4.8.x or later. Update GL.iNet BE10000 to version 4.8.x or later. Update GL.iNet E5800 to version 4.8.x or later. Update GL.iNet MT2500 to version 4.8.x or later. Update GL.iNet MT3000 to version 4.8.x or later. Update GL.iNet MT3600BE to version 4.8.x or later. Update GL.iNet MT5000 to version 4.8.x or later. Update GL.iNet MT6000 to version 4.8.x or later. Update GL.iNet X2000 to version 4.8.x or later. Update GL.iNet X3000 to version 4.8.x or later. Update GL.iNet XE3000 to version 4.8.x or later. As a temporary workaround, restrict access to the Wi-Fi Timer Power-Schedule Feature to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** GL.iNet BE9300 versions 4.8.x GL.iNet MT6000 versions 4.8.x **Description** An OS command injection flaw exists in the Firewall-management RPC component. A remote attacker can exploit this by manipulating the `dest port` and `dest ip` arguments, allowing for the execution of arbitrary operating system commands. **Recommendations** Upgrade GL.iNet BE9300 to version 4.9.0. Upgrade GL.iNet MT6000 to version 4.9.0.

**Name of the Vulnerable Software and Affected Versions** GL.iNet E5800 versions prior to 20260707 GL.iNet E750 versions prior to 20260707 GL.iNet X2000 versions prior to 20260707 GL.iNet X3000 versions prior to 20260707 GL.iNet XE3000 versions prior to 20260707 GL.iNet XE300 versions prior to 20260707 **Description** A flaw in the eSIM LPA API component allows for improper authorization. This issue occurs within the `/sdk/v1` file and can be exploited by an attacker located within the local network. **Recommendations** Update GL.iNet E5800 to a version released after 20260707. Update GL.iNet E750 to a version released after 20260707. Update GL.iNet X2000 to a version released after 20260707. Update GL.iNet X3000 to a version released after 20260707. Update GL.iNet XE3000 to a version released after 20260707. Update GL.iNet XE300 to a version released after 20260707.

**Name of the Vulnerable Software and Affected Versions** GL.iNet MT3000 versions prior to 20260707 GL.iNet MT6000 versions prior to 20260707 GL.iNet BE9300 versions prior to 20260707 GL.iNet BE3600 versions prior to 20260707 GL.iNet MT3600BE versions prior to 20260707 GL.iNet E5800 versions prior to 20260707 GL.iNet BE6500 versions prior to 20260707 GL.iNet MT5000 versions prior to 20260707 GL.iNet X3000 versions prior to 20260707 GL.iNet XE3000 versions prior to 20260707 GL.iNet MT2500 versions prior to 20260707 **Description** A remote attack can trigger a heap-based buffer overflow, which occurs when a program writes more data to a heap memory area than it can hold, potentially leading to crashes or arbitrary code execution. This issue exists within the APPS-NAS Module, specifically in the `nas-web.get file list()` function. **Recommendations** Update MT3000 to version 20260707 or later. Update MT6000 to version 20260707 or later. Update BE9300 to version 20260707 or later. Update BE3600 to version 20260707 or later. Update MT3600BE to version 20260707 or later. Update E5800 to version 20260707 or later. Update BE6500 to version 20260707 or later. Update MT5000 to version 20260707 or later. Update X3000 to version 20260707 or later. Update XE3000 to version 20260707 or later. Update MT2500 to version 20260707 or later. As a temporary workaround, restrict access to the `nas-web.get file list()` function within the APPS-NAS Module.

**Name of the Vulnerable Software and Affected Versions** GL.iNet A1300 versions prior to 4.9.0 GL.iNet AX1800 versions prior to 4.9.0 GL.iNet AXT1800 versions prior to 4.9.0 GL.iNet MT2500 versions prior to 4.9.0 GL.iNet MT3000 versions prior to 4.9.0 GL.iNet MT6000 versions prior to 4.9.0 GL.iNet X3000 versions prior to 4.9.0 GL.iNet XE3000 versions prior to 4.9.0 **Description** A flaw in the `glnassys` component allows a remote attacker to manipulate the system, leading to the use of a hard-coded cryptographic key. This attack is characterized by high complexity and is reported as difficult to exploit. **Recommendations** Update to version 4.9.0 Upgrade the `glnassys` component

Name of the Vulnerable Software and Affected Versions GL.iNet GL-RM1, GL-RM10, GL-RM10RC and GL-RM1PE versions 1.8.1 Description A security flaw exists in the Factory Reset Handler component, leading to improper authentication. The attack can be initiated remotely, but exploitation is difficult. The vendor responded promptly and released a fixed version. Recommendations Upgrade to version 1.8.2.