CVE-2024-28077
CVE-2024-28077 is a high-severity vulnerability in Gl-inet Mt6000 Firmware with a CVSS 3.x base score of 7.5. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low.
Key facts
- Severity: High (CVSS 3.x base score 7.5)
- EPSS exploit prediction: 0% (35th percentile)
- Actively exploited: Not listed in CISA KEV
- EU (EUVD) id: EUVD-2024-25244
- Affected product: Gl-inet Mt6000 Firmware
- Published:
- Last modified:
Description
A denial-of-service issue was discovered on certain GL-iNet devices. Some websites can detect devices exposed to the external network through DDNS, and consequently obtain the IP addresses and ports of devices that are exposed. By using special usernames and special characters (such as half parentheses or square brackets), one can call the login interface and cause the session-management program to crash, resulting in customers being unable to log into their devices. This affects MT6000 4.5.6, XE3000 4.4.5, X3000 4.4.6, MT3000 4.5.0, MT2500 4.5.0, AXT1800 4.5.0, AX1800 4.5.0, A1300 4.5.0, S200 4.1.4-0300, X750 4.3.7, SFT1200 4.3.7, MT1300 4.3.10, AR750 4.3.10, AR750S 4.3.10, AR300M 4.3.10, AR300M16 4.3.10, B1300 4.3.10, MT300N-V2 4.3.10, and XE300 4.3.16.
Frequently asked questions
- What is CVE-2024-28077?
- A denial-of-service issue was discovered on certain GL-iNet devices. Some websites can detect devices exposed to the external network through DDNS, and consequently obtain the IP addresses and ports of devices that are exposed. By using special usernames and special characters (such as half parentheses or square brackets), one can call the login interface and cause the session-management program to crash, resulting in customers being unable to log into their devices. This affects MT6000 4.5.6, XE3000 4.4.5, X3000 4.4.6, MT3000 4.5.0, MT2500 4.5.0, AXT1800 4.5.0, AX1800 4.5.0, A1300 4.5.0, S200 4.1.4-0300, X750 4.3.7, SFT1200 4.3.7, MT1300 4.3.10, AR750 4.3.10, AR750S 4.3.10, AR300M 4.3.10, AR300M16 4.3.10, B1300 4.3.10, MT300N-V2 4.3.10, and XE300 4.3.16.
- How severe is CVE-2024-28077?
- CVE-2024-28077 has a CVSS 3.x base score of 7.5, rated high severity. It is exploitable over network with low attack complexity, requires no privileges and no user interaction. Impact on confidentiality is none, integrity none, and availability high.
- Is CVE-2024-28077 being actively exploited?
- It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 0% (35th percentile), an estimate of the probability of exploitation in the next 30 days.
- What products are affected by CVE-2024-28077?
- CVE-2024-28077 primarily affects Gl-inet Mt6000 Firmware. In total, 18 product configurations (CPEs) are listed as vulnerable; see the affected-products list for the exact versions.
- How do I fix CVE-2024-28077?
- Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround. Given its high severity, prioritise patching exposed systems.
- Does CVE-2024-28077 have an EU (EUVD) identifier?
- Yes. CVE-2024-28077 is tracked in the ENISA EU Vulnerability Database (EUVD) as EUVD-2024-25244.
- When was CVE-2024-28077 published?
- CVE-2024-28077 was published on 2024-08-26 and last updated on 2026-06-17.
References
Affected products (18)
- cpe:2.3:o:gl-inet:mt6000_firmware:4.5.6:*:*:*:*:*:*:*
- cpe:2.3:o:gl-inet:x3000_firmware:4.4.6:*:*:*:*:*:*:*
- cpe:2.3:o:gl-inet:xe3000_firmware:4.4.4:*:*:*:*:*:*:*
- cpe:2.3:o:gl-inet:a1300_firmware:4.5.0:*:*:*:*:*:*:*
- cpe:2.3:o:gl-inet:ax1800_firmware:4.5.0:*:*:*:*:*:*:*
- cpe:2.3:o:gl-inet:axt1800_firmware:4.5.0:*:*:*:*:*:*:*
- cpe:2.3:o:gl-inet:mt2500_firmware:4.5.0:*:*:*:*:*:*:*
- cpe:2.3:o:gl-inet:mt3000_firmware:4.5.0:*:*:*:*:*:*:*
- cpe:2.3:o:gl-inet:xe300_firmware:4.3.16:*:*:*:*:*:*:*
- cpe:2.3:o:gl-inet:x750_firmware:4.3.7:*:*:*:*:*:*:*
- cpe:2.3:o:gl-inet:sft1200_firmware:4.3.7:*:*:*:*:*:*:*
- cpe:2.3:o:gl-inet:ar300m_firmware:4.3.10:*:*:*:*:*:*:*
- cpe:2.3:o:gl-inet:ar300m16_firmware:4.3.10:*:*:*:*:*:*:*
- cpe:2.3:o:gl-inet:ar750_firmware:4.3.10:*:*:*:*:*:*:*
- cpe:2.3:o:gl-inet:ar750s_firmware:4.3.10:*:*:*:*:*:*:*
- cpe:2.3:o:gl-inet:b1300_firmware:4.3.10:*:*:*:*:*:*:*
- cpe:2.3:o:gl-inet:mt1300_firmware:4.3.10:*:*:*:*:*:*:*
- cpe:2.3:o:gl-inet:mt300n-v2_firmware:4.3.10:*:*:*:*:*:*:*
More vulnerabilities in Gl-inet Mt6000 Firmware
- CVE-2024-39227 — Critical (CVSS 9.8): GL-iNet products AR750/AR750S/AR300M/AR300M16/MT300N-V2/B1300/MT1300/SFT1200/X750 v4.3.11,…
- CVE-2024-39228 — Critical (CVSS 9.8): GL-iNet products AR750/AR750S/AR300M/AR300M16/MT300N-V2/B1300/MT1300/SFT1200/X750 v4.3.11,…
- CVE-2024-39226 — Critical (CVSS 9.8): GL-iNet products AR750/AR750S/AR300M/AR300M16/MT300N-V2/B1300/MT1300/SFT1200/X750 v4.3.11,…
- CVE-2024-39225 — Critical (CVSS 9.8): GL-iNet products AR750/AR750S/AR300M/AR300M16/MT300N-V2/B1300/MT1300/SFT1200/X750 v4.3.11,…
- CVE-2024-45263 — High (CVSS 8.8): An issue was discovered on certain GL-iNet devices, including MT6000, MT3000, MT2500, AXT1800, and AX1800 4.6.2. The…
- CVE-2024-45262 — High (CVSS 8.8): An issue was discovered on certain GL-iNet devices, including MT6000, MT3000, MT2500, AXT1800, and AX1800 4.6.2. The…