GL-iNet Routers Exposed to Critical Vulnerabilities: Urgent Firmware Updates Required

GL-iNet has recently issued a security advisory addressing multiple critical vulnerabilities in several of their router models. The vulnerabilities, tracked under CVE-2024-39225 through CVE-2024-39229 and CVE-2024-3661, expose users to severe risks, including unauthenticated remote code execution (RCE) and man-in-the-middle attacks. Users are strongly urged to update their devices to the latest firmware versions to mitigate these threats.

Key Vulnerabilities

1. CVE-2024-39225 (CVSS 9.8): Unauthenticated Remote Code Execution (RCE)
   • This critical vulnerability allows an unauthenticated attacker to gain RCE as a root user. Exploitation requires precise timing to match the security identifier (SID) during an active session.
2. CVE-2024-39226 (CVSS 9.8): Missing Input Validation Leading to Arbitrary Code Execution
   • This flaw allows attackers to manipulate routers by passing malicious shell commands through the s2s API, leading to arbitrary code execution.
   • Impact: Full control over the device through command injection.
3. CVE-2024-39227 (CVSS 9.8): Missing Authorization Checks and Directory Traversal
   • This vulnerability permits direct access via HTTP to execute arbitrary methods within the C library, potentially leading to arbitrary code execution.
   • Impact: Full system compromise via directory traversal and improper JSON data sanitization.
4. CVE-2024-39228 (CVSS 9.8): Authenticated Remote Code Execution via Ovpn API
   • Attackers can exploit this flaw by passing malicious shell commands through the Ovpn API, resulting in arbitrary code execution.
   • Impact: Full control over the device after authentication through crafted configuration files and API calls.
5. CVE-2024-39229: DDNS Binding IP Address Modification
   • An issue allowing attackers to intercept communications via man-in-the-middle attacks when DDNS clients report data to the server.
   • Impact: Potential interception and manipulation of network traffic.
6. CVE-2024-3661 (CVSS 7.6): Tunnelvision Vulnerability via DHCP Option 121
   • This vulnerability allows an attacker on the same local network to read, disrupt, or modify network traffic expected to be protected by a VPN.
   • Impact: Leakage of traffic over the physical interface, undermining VPN security.

Affected Models and Firmware Versions

A wide range of GL-iNet router models are impacted, including popular ones like the Flint, Slate, Brume, and more.

Mitigating the Risk: Firmware Updates

GL-iNet has released firmware updates that address these vulnerabilities. Users must update their routers to the latest firmware versions as soon as possible to protect their networks from potential attacks. The updated firmware versions can be found on the GL-iNet website.

Related Posts:

• Hackers use Cisco Router flaws to attack Iran, 3,500 routers hacked
• US/UK warn Russia to hack into global routers
• Microsoft April Patch Tuesday includes mitigate Spectre Variant 2 for AMD processors