Multiple vulnerabilities in GL.iNet routers
| Risk | High |
| Patch available | YES |
| Number of vulnerabilities | 4 |
| CVE-ID | CVE-2024-57391 CVE-2025-2811 CVE-2025-2850 CVE-2025-2851 |
| CWE-ID | CWE-78 CWE-1333 CWE-285 CWE-119 |
| Exploitation vector | Network |
| Public exploit | N/A |
| Vulnerable software |
GL-AX1800 Flint Hardware solutions / Routers & switches, VoIP, GSM, etc GL-AXT1800 Slate AX Hardware solutions / Routers & switches, VoIP, GSM, etc GL-MT2500 Brume 2 Hardware solutions / Routers & switches, VoIP, GSM, etc GL-MT3000 Beryl AX Hardware solutions / Routers & switches, VoIP, GSM, etc GL-MT6000 Flint 2 Hardware solutions / Routers & switches, VoIP, GSM, etc GL-B3000 Marble Hardware solutions / Routers & switches, VoIP, GSM, etc GL-A1300 Slate Plus Hardware solutions / Routers & switches, VoIP, GSM, etc GL-X300B Collie Hardware solutions / Routers & switches, VoIP, GSM, etc GL-X3000 Spitz AX Hardware solutions / Routers & switches, VoIP, GSM, etc GL-XE3000 Puli AX Hardware solutions / Routers & switches, VoIP, GSM, etc GL-SFT1200 Opal Hardware solutions / Routers & switches, VoIP, GSM, etc GL-X750 Spitz Hardware solutions / Routers & switches, VoIP, GSM, etc GL-MT1300 Beryl Hardware solutions / Routers & switches, VoIP, GSM, etc GL-E750/GL-E750V2 Mudi Hardware solutions / Routers & switches, VoIP, GSM, etc GL-XE300 Puli Hardware solutions / Routers & switches, VoIP, GSM, etc GL-AR750 Creta Hardware solutions / Routers & switches, VoIP, GSM, etc GL-AR750S-EXT Slate Hardware solutions / Routers & switches, VoIP, GSM, etc GL-AR300M Shadow Hardware solutions / Routers & switches, VoIP, GSM, etc GL-AR300M16 Shadow Hardware solutions / Routers & switches, VoIP, GSM, etc GL-B1300 Convexa-B Hardware solutions / Routers & switches, VoIP, GSM, etc GL-MT300N-V2 Mango Hardware solutions / Routers & switches, VoIP, GSM, etc GL-BE3600 Slate 7 Hardware solutions / Routers & switches, VoIP, GSM, etc |
| Vendor | GL.iNet |
Security Bulletin
This security bulletin contains information about 4 vulnerabilities.
1) OS Command Injection
EUVDB-ID: #VU108909
Risk: Low
CVSSv4.0: 6.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]
CVE-ID: CVE-2024-57391
CWE-ID:
CWE-78 - Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Exploit availability: No
DescriptionThe vulnerability allows a remote user to execute arbitrary shell commands on the target system.
The vulnerability exists due to improper input validation. A remote administrator can pass specially crafted data to the application and execute arbitrary OS commands on the target system.
Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.
MitigationInstall updates from vendor's website.
Vulnerable software versionsGL-AX1800 Flint: - - 4.6.8
GL-AXT1800 Slate AX: - - 4.6.8
GL-MT2500 Brume 2: - - 4.7.0
GL-MT3000 Beryl AX: - - 4.7.0
GL-MT6000 Flint 2: - - 4.7.0
GL-B3000 Marble: - - 4.5.19
GL-A1300 Slate Plus: - - 4.5.19
GL-X300B Collie: - - 4.5.19
GL-X3000 Spitz AX: - - 4.4.13
GL-XE3000 Puli AX: - - 4.4.13
GL-SFT1200 Opal: - - 4.3.24
GL-X750 Spitz: - - 4.3.19
GL-MT1300 Beryl: - - 4.3.19
GL-E750/GL-E750V2 Mudi: - - 4.3.19
GL-XE300 Puli: - - 4.3.18
GL-AR750 Creta: - - 4.3.18
GL-AR750S-EXT Slate: - - 4.3.18
GL-AR300M Shadow: - - 4.3.18
GL-AR300M16 Shadow: - - 4.3.18
GL-B1300 Convexa-B: - - 4.3.18
GL-MT300N-V2 Mango: - - 4.3.18
GL-BE3600 Slate 7: All versions
CPE2.3- cpe:2.3:h:gl_inet:gl-ax1800_flint:*:*:*:*:*:*:*:*
- cpe:2.3:h:gl_inet:gl-ax1800_flint:4.6.8:*:*:*:*:*:*:*
- cpe:2.3:h:gl_inet:gl-axt1800_slate_ax:*:*:*:*:*:*:*:*
- cpe:2.3:h:gl_inet:gl-axt1800_slate_ax:4.6.8:*:*:*:*:*:*:*
- cpe:2.3:h:gl_inet:gl-mt2500_brume_2:*:*:*:*:*:*:*:*
- cpe:2.3:h:gl_inet:gl-mt2500_brume_2:4.7.0:*:*:*:*:*:*:*
- cpe:2.3:h:gl_inet:gl-mt3000_beryl_ax:*:*:*:*:*:*:*:*
- cpe:2.3:h:gl_inet:gl-mt3000_beryl_ax:4.7.0:*:*:*:*:*:*:*
- cpe:2.3:h:gl_inet:gl-mt6000_flint_2:*:*:*:*:*:*:*:*
- cpe:2.3:h:gl_inet:gl-mt6000_flint_2:4.7.0:*:*:*:*:*:*:*
- cpe:2.3:h:gl_inet:gl-b3000_marble:*:*:*:*:*:*:*:*
- cpe:2.3:h:gl_inet:gl-a1300_slate_plus:*:*:*:*:*:*:*:*
- cpe:2.3:h:gl_inet:gl-x300b_collie:*:*:*:*:*:*:*:*
- cpe:2.3:h:gl_inet:gl-x3000_spitz_ax:*:*:*:*:*:*:*:*
- cpe:2.3:h:gl_inet:gl-xe3000_puli_ax:*:*:*:*:*:*:*:*
- cpe:2.3:h:gl_inet:gl-sft1200_opal:*:*:*:*:*:*:*:*
- cpe:2.3:h:gl_inet:gl-x750_spitz:*:*:*:*:*:*:*:*
- cpe:2.3:h:gl_inet:gl-mt1300_beryl:*:*:*:*:*:*:*:*
- cpe:2.3:h:gl_inet:gl-e750_gl-e750v2_mudi:*:*:*:*:*:*:*:*
- cpe:2.3:h:gl_inet:gl-xe300_puli:*:*:*:*:*:*:*:*
- cpe:2.3:h:gl_inet:gl-ar750_creta:*:*:*:*:*:*:*:*
- cpe:2.3:h:gl_inet:gl-ar750s-ext_slate:*:*:*:*:*:*:*:*
- cpe:2.3:h:gl_inet:gl-ar300m_shadow:*:*:*:*:*:*:*:*
- cpe:2.3:h:gl_inet:gl-ar300m16_shadow:*:*:*:*:*:*:*:*
- cpe:2.3:h:gl_inet:gl-b1300_convexa-b:*:*:*:*:*:*:*:*
- cpe:2.3:h:gl_inet:gl-mt300n-v2_mango:*:*:*:*:*:*:*:*
- cpe:2.3:h:gl_inet:gl-be3600_slate_7:*:*:*:*:*:*:*:*
https://jvn.jp/en/vu/JVNVU93247159/index.html
https://www.gl-inet.com/security-updates/security-advisories-vulnerabilities-and-cves-apr-24-2025/
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote authenticated privileged user via the Internet.
How the attacker can exploit this vulnerability?
The attacker would have to send a specially crafted request to the affected device in order to exploit this vulnerability.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
2) Inefficient regular expression complexity
EUVDB-ID: #VU108911
Risk: High
CVSSv4.0: 6.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Amber]
CVE-ID: CVE-2025-2811
CWE-ID:
CWE-1333 - Inefficient Regular Expression Complexity
Exploit availability: No
DescriptionThe vulnerability allows a remote attacker to perform a denial of service (DoS) attack.
The vulnerability exists due to insufficient input validation when processing untrusted input with a regular expressions. A remote attacker can pass specially crafted data to the application and perform regular expression denial of service (ReDos) attack.
MitigationInstall updates from vendor's website.
Vulnerable software versionsGL-AX1800 Flint: - - 4.6.8
GL-AXT1800 Slate AX: - - 4.6.8
GL-MT2500 Brume 2: - - 4.7.0
GL-MT3000 Beryl AX: - - 4.7.0
GL-MT6000 Flint 2: - - 4.7.0
GL-B3000 Marble: - - 4.5.19
GL-A1300 Slate Plus: - - 4.5.19
GL-X300B Collie: - - 4.5.19
GL-X3000 Spitz AX: - - 4.4.13
GL-XE3000 Puli AX: - - 4.4.13
GL-SFT1200 Opal: - - 4.3.24
GL-X750 Spitz: - - 4.3.19
GL-MT1300 Beryl: - - 4.3.19
GL-E750/GL-E750V2 Mudi: - - 4.3.19
GL-XE300 Puli: - - 4.3.18
GL-AR750 Creta: - - 4.3.18
GL-AR750S-EXT Slate: - - 4.3.18
GL-AR300M Shadow: - - 4.3.18
GL-AR300M16 Shadow: - - 4.3.18
GL-B1300 Convexa-B: - - 4.3.18
GL-MT300N-V2 Mango: - - 4.3.18
GL-BE3600 Slate 7: All versions
CPE2.3- cpe:2.3:h:gl_inet:gl-ax1800_flint:*:*:*:*:*:*:*:*
- cpe:2.3:h:gl_inet:gl-ax1800_flint:4.6.8:*:*:*:*:*:*:*
- cpe:2.3:h:gl_inet:gl-axt1800_slate_ax:*:*:*:*:*:*:*:*
- cpe:2.3:h:gl_inet:gl-axt1800_slate_ax:4.6.8:*:*:*:*:*:*:*
- cpe:2.3:h:gl_inet:gl-mt2500_brume_2:*:*:*:*:*:*:*:*
- cpe:2.3:h:gl_inet:gl-mt2500_brume_2:4.7.0:*:*:*:*:*:*:*
- cpe:2.3:h:gl_inet:gl-mt3000_beryl_ax:*:*:*:*:*:*:*:*
- cpe:2.3:h:gl_inet:gl-mt3000_beryl_ax:4.7.0:*:*:*:*:*:*:*
- cpe:2.3:h:gl_inet:gl-mt6000_flint_2:*:*:*:*:*:*:*:*
- cpe:2.3:h:gl_inet:gl-mt6000_flint_2:4.7.0:*:*:*:*:*:*:*
- cpe:2.3:h:gl_inet:gl-b3000_marble:*:*:*:*:*:*:*:*
- cpe:2.3:h:gl_inet:gl-a1300_slate_plus:*:*:*:*:*:*:*:*
- cpe:2.3:h:gl_inet:gl-x300b_collie:*:*:*:*:*:*:*:*
- cpe:2.3:h:gl_inet:gl-x3000_spitz_ax:*:*:*:*:*:*:*:*
- cpe:2.3:h:gl_inet:gl-xe3000_puli_ax:*:*:*:*:*:*:*:*
- cpe:2.3:h:gl_inet:gl-sft1200_opal:*:*:*:*:*:*:*:*
- cpe:2.3:h:gl_inet:gl-x750_spitz:*:*:*:*:*:*:*:*
- cpe:2.3:h:gl_inet:gl-mt1300_beryl:*:*:*:*:*:*:*:*
- cpe:2.3:h:gl_inet:gl-e750_gl-e750v2_mudi:*:*:*:*:*:*:*:*
- cpe:2.3:h:gl_inet:gl-xe300_puli:*:*:*:*:*:*:*:*
- cpe:2.3:h:gl_inet:gl-ar750_creta:*:*:*:*:*:*:*:*
- cpe:2.3:h:gl_inet:gl-ar750s-ext_slate:*:*:*:*:*:*:*:*
- cpe:2.3:h:gl_inet:gl-ar300m_shadow:*:*:*:*:*:*:*:*
- cpe:2.3:h:gl_inet:gl-ar300m16_shadow:*:*:*:*:*:*:*:*
- cpe:2.3:h:gl_inet:gl-b1300_convexa-b:*:*:*:*:*:*:*:*
- cpe:2.3:h:gl_inet:gl-mt300n-v2_mango:*:*:*:*:*:*:*:*
- cpe:2.3:h:gl_inet:gl-be3600_slate_7:*:*:*:*:*:*:*:*
https://www.gl-inet.com/security-updates/security-advisories-vulnerabilities-and-cves-apr-24-2025/
https://jvn.jp/en/vu/JVNVU93247159/index.html
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.
How the attacker can exploit this vulnerability?
The attacker would have to send a specially crafted request to the affected device in order to exploit this vulnerability.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
3) Improper Authorization
EUVDB-ID: #VU108914
Risk: Medium
CVSSv4.0: 1.2 [CVSS:4.0/AV:A/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Green]
CVE-ID: CVE-2025-2850
CWE-ID:
CWE-285 - Improper Authorization
Exploit availability: No
DescriptionThe vulnerability allows a remote attacker to bypass authorization checks.
The vulnerability exists due to improper authorization. A remote user on the local network can cause arbitrary file download of router in download interfaces.
MitigationInstall updates from vendor's website.
Vulnerable software versionsGL-AX1800 Flint: - - 4.6.8
GL-AXT1800 Slate AX: - - 4.6.8
GL-MT2500 Brume 2: - - 4.7.0
GL-MT3000 Beryl AX: - - 4.7.0
GL-MT6000 Flint 2: - - 4.7.0
GL-B3000 Marble: - - 4.5.19
GL-A1300 Slate Plus: - - 4.5.19
GL-X300B Collie: - - 4.5.19
GL-X3000 Spitz AX: - - 4.4.13
GL-XE3000 Puli AX: - - 4.4.13
GL-SFT1200 Opal: - - 4.3.24
GL-X750 Spitz: - - 4.3.19
GL-MT1300 Beryl: - - 4.3.19
GL-E750/GL-E750V2 Mudi: - - 4.3.19
GL-XE300 Puli: - - 4.3.18
GL-AR750 Creta: - - 4.3.18
GL-AR750S-EXT Slate: - - 4.3.18
GL-AR300M Shadow: - - 4.3.18
GL-AR300M16 Shadow: - - 4.3.18
GL-B1300 Convexa-B: - - 4.3.18
GL-MT300N-V2 Mango: - - 4.3.18
GL-BE3600 Slate 7: All versions
CPE2.3- cpe:2.3:h:gl_inet:gl-ax1800_flint:*:*:*:*:*:*:*:*
- cpe:2.3:h:gl_inet:gl-ax1800_flint:4.6.8:*:*:*:*:*:*:*
- cpe:2.3:h:gl_inet:gl-axt1800_slate_ax:*:*:*:*:*:*:*:*
- cpe:2.3:h:gl_inet:gl-axt1800_slate_ax:4.6.8:*:*:*:*:*:*:*
- cpe:2.3:h:gl_inet:gl-mt2500_brume_2:*:*:*:*:*:*:*:*
- cpe:2.3:h:gl_inet:gl-mt2500_brume_2:4.7.0:*:*:*:*:*:*:*
- cpe:2.3:h:gl_inet:gl-mt3000_beryl_ax:*:*:*:*:*:*:*:*
- cpe:2.3:h:gl_inet:gl-mt3000_beryl_ax:4.7.0:*:*:*:*:*:*:*
- cpe:2.3:h:gl_inet:gl-mt6000_flint_2:*:*:*:*:*:*:*:*
- cpe:2.3:h:gl_inet:gl-mt6000_flint_2:4.7.0:*:*:*:*:*:*:*
- cpe:2.3:h:gl_inet:gl-b3000_marble:*:*:*:*:*:*:*:*
- cpe:2.3:h:gl_inet:gl-a1300_slate_plus:*:*:*:*:*:*:*:*
- cpe:2.3:h:gl_inet:gl-x300b_collie:*:*:*:*:*:*:*:*
- cpe:2.3:h:gl_inet:gl-x3000_spitz_ax:*:*:*:*:*:*:*:*
- cpe:2.3:h:gl_inet:gl-xe3000_puli_ax:*:*:*:*:*:*:*:*
- cpe:2.3:h:gl_inet:gl-sft1200_opal:*:*:*:*:*:*:*:*
- cpe:2.3:h:gl_inet:gl-x750_spitz:*:*:*:*:*:*:*:*
- cpe:2.3:h:gl_inet:gl-mt1300_beryl:*:*:*:*:*:*:*:*
- cpe:2.3:h:gl_inet:gl-e750_gl-e750v2_mudi:*:*:*:*:*:*:*:*
- cpe:2.3:h:gl_inet:gl-xe300_puli:*:*:*:*:*:*:*:*
- cpe:2.3:h:gl_inet:gl-ar750_creta:*:*:*:*:*:*:*:*
- cpe:2.3:h:gl_inet:gl-ar750s-ext_slate:*:*:*:*:*:*:*:*
- cpe:2.3:h:gl_inet:gl-ar300m_shadow:*:*:*:*:*:*:*:*
- cpe:2.3:h:gl_inet:gl-ar300m16_shadow:*:*:*:*:*:*:*:*
- cpe:2.3:h:gl_inet:gl-b1300_convexa-b:*:*:*:*:*:*:*:*
- cpe:2.3:h:gl_inet:gl-mt300n-v2_mango:*:*:*:*:*:*:*:*
- cpe:2.3:h:gl_inet:gl-be3600_slate_7:*:*:*:*:*:*:*:*
https://www.gl-inet.com/security-updates/security-advisories-vulnerabilities-and-cves-apr-24-2025/
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote authenticated user via the local network (LAN).
How the attacker can exploit this vulnerability?
The attacker would have to send a specially crafted request to the affected device in order to exploit this vulnerability.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
4) Buffer overflow
EUVDB-ID: #VU108916
Risk: Medium
CVSSv4.0: 6.1 [CVSS:4.0/AV:A/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Green]
CVE-ID: CVE-2025-2851
CWE-ID:
CWE-119 - Memory corruption
Exploit availability: No
DescriptionThe vulnerability allows a remote attacker to execute arbitrary code on the target system.
The vulnerability exists due to a boundary error within the rpc in the plugins.so library. A remote user on the local network can trigger memory corruption and execute arbitrary code on the target system.
MitigationInstall updates from vendor's website.
Vulnerable software versionsGL-AX1800 Flint: - - 4.6.8
GL-AXT1800 Slate AX: - - 4.6.8
GL-MT2500 Brume 2: - - 4.7.0
GL-MT3000 Beryl AX: - - 4.7.0
GL-MT6000 Flint 2: - - 4.7.0
GL-B3000 Marble: - - 4.5.19
GL-A1300 Slate Plus: - - 4.5.19
GL-X300B Collie: - - 4.5.19
GL-X3000 Spitz AX: - - 4.4.13
GL-XE3000 Puli AX: - - 4.4.13
GL-SFT1200 Opal: - - 4.3.24
GL-X750 Spitz: - - 4.3.19
GL-MT1300 Beryl: - - 4.3.19
GL-E750/GL-E750V2 Mudi: - - 4.3.19
GL-XE300 Puli: - - 4.3.18
GL-AR750 Creta: - - 4.3.18
GL-AR750S-EXT Slate: - - 4.3.18
GL-AR300M Shadow: - - 4.3.18
GL-AR300M16 Shadow: - - 4.3.18
GL-B1300 Convexa-B: - - 4.3.18
GL-MT300N-V2 Mango: - - 4.3.18
GL-BE3600 Slate 7: All versions
CPE2.3- cpe:2.3:h:gl_inet:gl-ax1800_flint:*:*:*:*:*:*:*:*
- cpe:2.3:h:gl_inet:gl-ax1800_flint:4.6.8:*:*:*:*:*:*:*
- cpe:2.3:h:gl_inet:gl-axt1800_slate_ax:*:*:*:*:*:*:*:*
- cpe:2.3:h:gl_inet:gl-axt1800_slate_ax:4.6.8:*:*:*:*:*:*:*
- cpe:2.3:h:gl_inet:gl-mt2500_brume_2:*:*:*:*:*:*:*:*
- cpe:2.3:h:gl_inet:gl-mt2500_brume_2:4.7.0:*:*:*:*:*:*:*
- cpe:2.3:h:gl_inet:gl-mt3000_beryl_ax:*:*:*:*:*:*:*:*
- cpe:2.3:h:gl_inet:gl-mt3000_beryl_ax:4.7.0:*:*:*:*:*:*:*
- cpe:2.3:h:gl_inet:gl-mt6000_flint_2:*:*:*:*:*:*:*:*
- cpe:2.3:h:gl_inet:gl-mt6000_flint_2:4.7.0:*:*:*:*:*:*:*
- cpe:2.3:h:gl_inet:gl-b3000_marble:*:*:*:*:*:*:*:*
- cpe:2.3:h:gl_inet:gl-a1300_slate_plus:*:*:*:*:*:*:*:*
- cpe:2.3:h:gl_inet:gl-x300b_collie:*:*:*:*:*:*:*:*
- cpe:2.3:h:gl_inet:gl-x3000_spitz_ax:*:*:*:*:*:*:*:*
- cpe:2.3:h:gl_inet:gl-xe3000_puli_ax:*:*:*:*:*:*:*:*
- cpe:2.3:h:gl_inet:gl-sft1200_opal:*:*:*:*:*:*:*:*
- cpe:2.3:h:gl_inet:gl-x750_spitz:*:*:*:*:*:*:*:*
- cpe:2.3:h:gl_inet:gl-mt1300_beryl:*:*:*:*:*:*:*:*
- cpe:2.3:h:gl_inet:gl-e750_gl-e750v2_mudi:*:*:*:*:*:*:*:*
- cpe:2.3:h:gl_inet:gl-xe300_puli:*:*:*:*:*:*:*:*
- cpe:2.3:h:gl_inet:gl-ar750_creta:*:*:*:*:*:*:*:*
- cpe:2.3:h:gl_inet:gl-ar750s-ext_slate:*:*:*:*:*:*:*:*
- cpe:2.3:h:gl_inet:gl-ar300m_shadow:*:*:*:*:*:*:*:*
- cpe:2.3:h:gl_inet:gl-ar300m16_shadow:*:*:*:*:*:*:*:*
- cpe:2.3:h:gl_inet:gl-b1300_convexa-b:*:*:*:*:*:*:*:*
- cpe:2.3:h:gl_inet:gl-mt300n-v2_mango:*:*:*:*:*:*:*:*
- cpe:2.3:h:gl_inet:gl-be3600_slate_7:*:*:*:*:*:*:*:*
https://www.gl-inet.com/security-updates/security-advisories-vulnerabilities-and-cves-apr-24-2025/
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote authenticated user via the local network (LAN).
How the attacker can exploit this vulnerability?
The attacker would have to send a specially crafted request to the affected device in order to exploit this vulnerability.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
