CVE-2024-39229

MEDIUM EPSS 7.6%
Published Aug 6, 20241y ago · Modified Jun 17, 20261w ago
5.3 CVSS 3.1
Medium
Find Similar
Published Aug 6, 2024 1y ago
Last Modified Jun 17, 2026 1w ago

Description

An issue in GL-iNet products AR750/AR750S/AR300M/AR300M16/MT300N-V2/B1300/MT1300/SFT1200/X750 v4.3.11, MT3000/MT2500/AXT1800/AX1800/A1300/X300B v4.5.16, XE300 v4.3.16, E750 v4.3.12, AP1300/S1300 v4.3.13, XE3000/X3000 v4, and B2200/MV1000/MV1000W/USB150/N300/SF1200 v3.216 allows attackers to intercept communications via a man-in-the-middle attack when DDNS clients are reporting data to the server.

CVSS Details

Base Score
5.3
Exploitability
1.6
Impact
3.6
Vector string
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:N
Attack Vector Network
Attack Complexity High
Privileges Required Low
User Interaction None
Scope Unchanged
Confidentiality None
Integrity High
Availability None

Threat Intelligence

EPSS Exploit Probability
7.6% percentile
Exploit & Patch Status
Public Exploit Known
No Patch Available

Weaknesses 1

CWE-924

Affected Products 56

VendorProductVersionRange
gl-inetmt6000_firmware4.5.8any
gl-inetmt6000*any
gl-ineta1300_firmware4.5.16any
gl-ineta1300*any
gl-inetx300b_firmware4.5.16any
gl-inetx300b*any
gl-inetax1800_firmware4.5.16any
gl-inetax1800*any
gl-inetaxt1800_firmware4.5.16any
gl-inetaxt1800*any
gl-inetmt2500_firmware4.5.16any
gl-inetmt2500*any
gl-inetmt3000_firmware4.5.16any
gl-inetmt3000*any
gl-inetx3000_firmware4.4.8any
gl-inetx3000*any
gl-inetxe3000_firmware4.4.8any
gl-inetxe3000*any
gl-inetxe300_firmware4.3.16any
gl-inetxe300*any
gl-inete750_firmware4.3.12any
gl-inete750*any
gl-inetx750_firmware4.3.11any
gl-inetx750*any
gl-inetsft1200_firmware4.3.11any
gl-inetsft1200*any
gl-inetar300m_firmware4.3.11any
gl-inetar300m*any
gl-inetar300m16_firmware4.3.11any
gl-inetar300m16*any
gl-inetar750_firmware4.3.11any
gl-inetar750*any
gl-inetar750s_firmware4.3.11any
gl-inetar750s*any
gl-inetb1300_firmware4.3.11any
gl-inetb1300*any
gl-inetmt1300_firmware4.3.11any
gl-inetmt1300*any
gl-inetmt300n-v2_firmware4.3.11any
gl-inetmt300n-v2*any
gl-inetap1300_firmware3.217any
gl-inetap1300*any
gl-inetb2200_firmware3.216any
gl-inetb2200*any
gl-inetmv1000_firmware3.216any
gl-inetmv1000*any
gl-inetmv1000w_firmware3.216any
gl-inetmv1000w*any
gl-inetusb150_firmware3.216any
gl-inetusb150*any
gl-inetsf1200_firmware3.216any
gl-inetsf1200*any
gl-inetn300_firmware3.216any
gl-inetn300*any
gl-inets1300_firmware3.216any
gl-inets1300*any

References 1

  • github.com https://github.com/gl-inet/CVE-issues/blob/main/4.0.0/DDNS%20data%20is%20not%20encrypted.md
    ExploitThird Party Advisory

Remediation

No remediation data recorded yet

Check vendor advisories and the NVD entry for patch availability.