Medium severity · published Aug 6, 2024
CVE-2024-39229
An issue in GL-iNet products AR750/AR750S/AR300M/AR300M16/MT300N-V2/B1300/MT1300/SFT1200/X750 v4.3.11, MT3000/MT2500/AXT1800/AX1800/A1300/X300B v4.5.16, XE300 v4.3.16, E750…
5.3
CVSS
0.2%
EPSS
No
On KEV
Description
An issue in GL-iNet products AR750/AR750S/AR300M/AR300M16/MT300N-V2/B1300/MT1300/SFT1200/X750 v4.3.11, MT3000/MT2500/AXT1800/AX1800/A1300/X300B v4.5.16, XE300 v4.3.16, E750 v4.3.12, AP1300/S1300 v4.3.13, XE3000/X3000 v4, and B2200/MV1000/MV1000W/USB150/N300/SF1200 v3.216 allows attackers to intercept communications via a man-in-the-middle attack when DDNS clients are reporting data to the server.
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:N
Attack vector
Network
Complexity
High
Privileges
Low
User interaction
None
Confidentiality
None
Integrity
High
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.2% · higher than 7% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
AF
A1300 Firmware · Gl-inet
4.5.16 · source: NVD
AF
Ap1300 Firmware · Gl-inet
3.217 · source: NVD
AF
Ar300m Firmware · Gl-inet
4.3.11 · source: NVD
AF
Ar300m16 Firmware · Gl-inet
4.3.11 · source: NVD
AF
Ar750 Firmware · Gl-inet
4.3.11 · source: NVD
AF
Ar750s Firmware · Gl-inet
4.3.11 · source: NVD
AF
Ax1800 Firmware · Gl-inet
4.5.16 · source: NVD
AF
Axt1800 Firmware · Gl-inet
4.5.16 · source: NVD
BF
B1300 Firmware · Gl-inet
4.3.11 · source: NVD
BF
B2200 Firmware · Gl-inet
3.216 · source: NVD
EF
E750 Firmware · Gl-inet
4.3.12 · source: NVD
MF
Mt1300 Firmware · Gl-inet
4.3.11 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2024-39229
CVE.org
https://www.cve.org/CVERecord?id=CVE-2024-39229
Exploit
https://github.com/gl-inet/CVE-issues/blob/main/4.0.0/DDNS%20data%20is%20not%20encrypted.md
More from A1300 Firmware
9.8
CVE-2024-39225
GL-iNet products AR750/AR750S/AR300M/AR300M16/MT300N-V2/B1300/MT1300/SFT1200/X750 v4.3.11, MT3000/MT2500/AXT1800/AX1800/A1300/X300B v4.5.16, XE300 v4.3.16, E750 v4.3.12,…
9.8
CVE-2024-39226
GL-iNet products AR750/AR750S/AR300M/AR300M16/MT300N-V2/B1300/MT1300/SFT1200/X750 v4.3.11, MT3000/MT2500/AXT1800/AX1800/A1300/X300B v4.5.16, XE300 v4.3.16, E750 v4.3.12,…
9.8
CVE-2024-39228
GL-iNet products AR750/AR750S/AR300M/AR300M16/MT300N-V2/B1300/MT1300/SFT1200/X750 v4.3.11, MT3000/MT2500/AXT1800/AX1800/A1300/X300B v4.5.16, XE300 v4.3.16, E750 v4.3.12,…
9.8
CVE-2024-39227
GL-iNet products AR750/AR750S/AR300M/AR300M16/MT300N-V2/B1300/MT1300/SFT1200/X750 v4.3.11, MT3000/MT2500/AXT1800/AX1800/A1300/X300B v4.5.16, XE300 v4.3.16, E750 v4.3.12,…
8.8
CVE-2024-45262
An issue was discovered on certain GL-iNet devices, including MT6000, MT3000, MT2500, AXT1800, and AX1800 4.6.2