{"dataType": "CVE_RECORD", "cveMetadata": {"state": "PUBLISHED", "cveId": "CVE-2024-45261", "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "assignerShortName": "mitre", "dateUpdated": "2024-10-28T19:19:59.290Z", "dateReserved": "2024-08-25T00:00:00", "datePublished": "2024-10-24T00:00:00"}, "containers": {"cna": {"providerMetadata": {"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "shortName": "mitre", "dateUpdated": "2024-10-24T20:18:25.796189"}, "descriptions": [{"lang": "en", "value": "An issue was discovered on certain GL-iNet devices, including MT6000, MT3000, MT2500, AXT1800, and AX1800 4.6.2. The SID generated for a specific user is not tied to that user itself, which allows other users to potentially use it for authentication. Once an attacker bypasses the application's authentication procedures, they can generate a valid SID, escalate privileges, and gain full control."}], "affected": [{"vendor": "n/a", "product": "n/a", "versions": [{"version": "n/a", "status": "affected"}]}], "references": [{"url": "https://github.com/gl-inet/CVE-issues/blob/main/4.0.0/Bypassing%20Login%20Mechanism%20with%20Passwordless%20User%20Login.md"}], "problemTypes": [{"descriptions": [{"type": "text", "lang": "en", "description": "n/a"}]}]}, "adp": [{"problemTypes": [{"descriptions": [{"type": "CWE", "cweId": "CWE-863", "lang": "en", "description": "CWE-863 Incorrect Authorization"}]}], "affected": [{"vendor": "gl-inet", "product": "gl-b3000_firmware", "cpes": ["cpe:2.3:o:gl-inet:gl-b3000_firmware:*:*:*:*:*:*:*:*"], "defaultStatus": "unknown", "versions": [{"version": "4.5.18", "status": "affected", "lessThan": "4.5.19", "versionType": "custom"}]}, {"vendor": "gl-inet", "product": "gl-mt6000_firmware", "cpes": ["cpe:2.3:o:gl-inet:gl-ax1800_firmware:*:*:*:*:*:*:*:*", "cpe:2.3:o:gl-inet:gl-axt1800_firmware:-:*:*:*:*:*:*:*", "cpe:2.3:o:gl-inet:gl-mt2500_firmware:-:*:*:*:*:*:*:*", "cpe:2.3:o:gl-inet:gl-mt3000_firmware:-:*:*:*:*:*:*:*", "cpe:2.3:o:gl-inet:gl-mt6000_firmware:*:*:*:*:*:*:*:*"], "defaultStatus": "unknown", "versions": [{"version": "4.6.2", "status": "affected", "lessThan": "4.6.4", "versionType": "custom"}]}, {"vendor": "gl-inet", "product": "gl-x300b_firmware", "cpes": ["cpe:2.3:o:gl-inet:gl-a1300_firmware:-:*:*:*:*:*:*:*", "cpe:2.3:o:gl-inet:gl-x300b_firmware:-:*:*:*:*:*:*:*"], "defaultStatus": "unknown", "versions": [{"version": "4.5.17", "status": "affected", "lessThan": "4.5.18", "versionType": "custom"}]}, {"vendor": "gl-inet", "product": "gl-xe300_firmware", "cpes": ["cpe:2.3:o:gl-inet:gl-x3000_firmware:-:*:*:*:*:*:*:*", "cpe:2.3:o:gl-inet:gl-xe300_firmware:-:*:*:*:*:*:*:*"], "defaultStatus": "unknown", "versions": [{"version": "4.4.9", "status": "affected", "lessThan": "4.4.10", "versionType": "custom"}]}, {"vendor": "gl-inet", "product": "gl-x750_firmware", "cpes": ["cpe:2.3:o:gl-inet:gl-mt1300_firmware:-:*:*:*:*:*:*:*", "cpe:2.3:o:gl-inet:gl-sft1200_firmware:-:*:*:*:*:*:*:*", "cpe:2.3:o:gl-inet:gl-x750_firmware:-:*:*:*:*:*:*:*"], "defaultStatus": "unknown", "versions": [{"version": "4.3.18", "status": "affected", "lessThan": "4.3.19", "versionType": "custom"}]}, {"vendor": "gl-inet", "product": "gl-xe300_firmware", "cpes": ["cpe:2.3:o:gl-inet:gl-ar300m16_firmware:*:*:*:*:*:*:*:*", "cpe:2.3:o:gl-inet:gl-ar750_firmware:-:*:*:*:*:*:*:*", "cpe:2.3:o:gl-inet:gl-ar300m_firmware:-:*:*:*:*:*:*:*", "cpe:2.3:o:gl-inet:gl-ar750s_firmware:-:*:*:*:*:*:*:*", "cpe:2.3:o:gl-inet:gl-b1300_firmware:-:*:*:*:*:*:*:*", "cpe:2.3:o:gl-inet:gl-e750_firmware:-:*:*:*:*:*:*:*", "cpe:2.3:o:gl-inet:gl-mt300n-v2_firmware:-:*:*:*:*:*:*:*", "cpe:2.3:o:gl-inet:gl-xe300_firmware:-:*:*:*:*:*:*:*"], "defaultStatus": "unknown", "versions": [{"version": "4.3.17", "status": "affected", "lessThan": "4.3.18", "versionType": "custom"}]}], "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8, "attackVector": "ADJACENT_NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}}, {"other": {"type": "ssvc", "content": {"timestamp": "2024-10-28T19:12:05.989024Z", "id": "CVE-2024-45261", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-10-28T19:19:59.290Z"}}]}, "dataVersion": "5.1"}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8, "attackVector": "ADJACENT_NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}}, {"other": {"type": "ssvc", "content": {"id": "CVE-2024-45261", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2024-10-28T19:12:05.989024Z"}}}], "affected": [{"cpes": ["cpe:2.3:o:gl-inet:gl-b3000_firmware:*:*:*:*:*:*:*:*"], "vendor": "gl-inet", "product": "gl-b3000_firmware", "versions": [{"status": "affected", "version": "4.5.18", "lessThan": "4.5.19", "versionType": "custom"}], "defaultStatus": "unknown"}, {"cpes": ["cpe:2.3:o:gl-inet:gl-ax1800_firmware:*:*:*:*:*:*:*:*", "cpe:2.3:o:gl-inet:gl-axt1800_firmware:-:*:*:*:*:*:*:*", "cpe:2.3:o:gl-inet:gl-mt2500_firmware:-:*:*:*:*:*:*:*", "cpe:2.3:o:gl-inet:gl-mt3000_firmware:-:*:*:*:*:*:*:*", "cpe:2.3:o:gl-inet:gl-mt6000_firmware:*:*:*:*:*:*:*:*"], "vendor": "gl-inet", "product": "gl-mt6000_firmware", "versions": [{"status": "affected", "version": "4.6.2", "lessThan": "4.6.4", "versionType": "custom"}], "defaultStatus": "unknown"}, {"cpes": ["cpe:2.3:o:gl-inet:gl-a1300_firmware:-:*:*:*:*:*:*:*", "cpe:2.3:o:gl-inet:gl-x300b_firmware:-:*:*:*:*:*:*:*"], "vendor": "gl-inet", "product": "gl-x300b_firmware", "versions": [{"status": "affected", "version": "4.5.17", "lessThan": "4.5.18", "versionType": "custom"}], "defaultStatus": "unknown"}, {"cpes": ["cpe:2.3:o:gl-inet:gl-x3000_firmware:-:*:*:*:*:*:*:*", "cpe:2.3:o:gl-inet:gl-xe300_firmware:-:*:*:*:*:*:*:*"], "vendor": "gl-inet", "product": "gl-xe300_firmware", "versions": [{"status": "affected", "version": "4.4.9", "lessThan": "4.4.10", "versionType": "custom"}], "defaultStatus": "unknown"}, {"cpes": ["cpe:2.3:o:gl-inet:gl-mt1300_firmware:-:*:*:*:*:*:*:*", "cpe:2.3:o:gl-inet:gl-sft1200_firmware:-:*:*:*:*:*:*:*", "cpe:2.3:o:gl-inet:gl-x750_firmware:-:*:*:*:*:*:*:*"], "vendor": "gl-inet", "product": "gl-x750_firmware", "versions": [{"status": "affected", "version": "4.3.18", "lessThan": "4.3.19", "versionType": "custom"}], "defaultStatus": "unknown"}, {"cpes": ["cpe:2.3:o:gl-inet:gl-ar300m16_firmware:*:*:*:*:*:*:*:*", "cpe:2.3:o:gl-inet:gl-ar750_firmware:-:*:*:*:*:*:*:*", "cpe:2.3:o:gl-inet:gl-ar300m_firmware:-:*:*:*:*:*:*:*", "cpe:2.3:o:gl-inet:gl-ar750s_firmware:-:*:*:*:*:*:*:*", "cpe:2.3:o:gl-inet:gl-b1300_firmware:-:*:*:*:*:*:*:*", "cpe:2.3:o:gl-inet:gl-e750_firmware:-:*:*:*:*:*:*:*", "cpe:2.3:o:gl-inet:gl-mt300n-v2_firmware:-:*:*:*:*:*:*:*", "cpe:2.3:o:gl-inet:gl-xe300_firmware:-:*:*:*:*:*:*:*"], "vendor": "gl-inet", "product": "gl-xe300_firmware", "versions": [{"status": "affected", "version": "4.3.17", "lessThan": "4.3.18", "versionType": "custom"}], "defaultStatus": "unknown"}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-863", "description": "CWE-863 Incorrect Authorization"}]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-10-28T19:01:43.032Z"}}], "cna": {"affected": [{"vendor": "n/a", "product": "n/a", "versions": [{"status": "affected", "version": "n/a"}]}], "references": [{"url": "https://github.com/gl-inet/CVE-issues/blob/main/4.0.0/Bypassing%20Login%20Mechanism%20with%20Passwordless%20User%20Login.md"}], "descriptions": [{"lang": "en", "value": "An issue was discovered on certain GL-iNet devices, including MT6000, MT3000, MT2500, AXT1800, and AX1800 4.6.2. The SID generated for a specific user is not tied to that user itself, which allows other users to potentially use it for authentication. Once an attacker bypasses the application's authentication procedures, they can generate a valid SID, escalate privileges, and gain full control."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "text", "description": "n/a"}]}], "providerMetadata": {"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "shortName": "mitre", "dateUpdated": "2024-10-24T20:18:25.796189"}}}, "cveMetadata": {"cveId": "CVE-2024-45261", "state": "PUBLISHED", "dateUpdated": "2024-10-28T19:19:59.290Z", "dateReserved": "2024-08-25T00:00:00", "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "datePublished": "2024-10-24T00:00:00", "assignerShortName": "mitre"}, "dataVersion": "5.1"}

{"cveTags": [], "descriptions": [{"lang": "en", "value": "An issue was discovered on certain GL-iNet devices, including MT6000, MT3000, MT2500, AXT1800, and AX1800 4.6.2. The SID generated for a specific user is not tied to that user itself, which allows other users to potentially use it for authentication. Once an attacker bypasses the application's authentication procedures, they can generate a valid SID, escalate privileges, and gain full control."}, {"lang": "es", "value": "Se descubri\u00f3 un problema en ciertos dispositivos GL-iNet, incluidos MT6000, MT3000, MT2500, AXT1800 y AX1800 4.6.2. El SID generado para un usuario espec\u00edfico no est\u00e1 vinculado a ese usuario en s\u00ed, lo que permite que otros usuarios lo utilicen potencialmente para la autenticaci\u00f3n. Una vez que un atacante elude los procedimientos de autenticaci\u00f3n de la aplicaci\u00f3n, puede generar un SID v\u00e1lido, escalar privilegios y obtener el control total."}], "id": "CVE-2024-45261", "lastModified": "2024-10-28T20:35:15.213", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "ADJACENT_NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.0, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 2.1, "impactScore": 5.9, "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}]}, "published": "2024-10-24T21:15:12.057", "references": [{"source": "cve@mitre.org", "url": "https://github.com/gl-inet/CVE-issues/blob/main/4.0.0/Bypassing%20Login%20Mechanism%20with%20Passwordless%20User%20Login.md"}], "sourceIdentifier": "cve@mitre.org", "vulnStatus": "Awaiting Analysis", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-863"}], "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}]}

{}