CVE-2024-39229

moderate-risk

Published 2024-08-06

An issue in GL-iNet products AR750/AR750S/AR300M/AR300M16/MT300N-V2/B1300/MT1300/SFT1200/X750 v4.3.11, MT3000/MT2500/AXT1800/AX1800/A1300/X300B v4.5.16, XE300 v4.3.16, E750 v4.3.12, AP1300/S1300 v4.3.13, XE3000/X3000 v4, and B2200/MV1000/MV1000W/USB150/N300/SF1200 v3.216 allows attackers to intercept communications via a man-in-the-middle attack when DDNS clients are reporting data to the server.

Do I need to act?

0.09% chance of exploitation

EPSS score — low exploit probability

Not on CISA KEV list

No confirmed active exploitation reported to CISA

Patch status unknown

Check vendor advisories for fix availability and mitigation guidance

CVSS 5.3/10 Medium

NETWORK / HIGH complexity

Affected Products (20)

Mt6000 Firmware

A1300 Firmware

X300B Firmware

Ax1800 Firmware

Axt1800 Firmware

Mt2500 Firmware

Mt3000 Firmware

X3000 Firmware

Xe3000 Firmware

Xe300 Firmware

E750 Firmware

X750 Firmware

Sft1200 Firmware

Ar300M Firmware

Ar300M16 Firmware

Ar750 Firmware

Ar750S Firmware

B1300 Firmware

Mt1300 Firmware

Mt300N-V2 Firmware

Affected Vendors

Gl-Inet

References (1)

Exploit https://github.com/gl-inet/CVE-issues/blob/main/4.0.0/DDNS%20data%20is%20not%20e...

/ 100

moderate-risk

Severity 17/34 · Moderate

Exploitability 0/34 · Minimal

Exposure 22/34 · High