PatchTheCVE: mt2500 firmwarehttps://patchthecve.com/CVEs with upgrade or downgrade fix stepsCVE-2024-45263: An issue was discovered on certain GL-iNet devices, including MT6000, MT3000, MT2500, AXT1800, and AX1800 4.6.https://patchthecve.com/cve/CVE-2024-45263.htmlhttps://patchthecve.com/cve/CVE-2024-45263.htmlWed, 17 Jun 2026 07:53:53 +0000HIGH 8.8: An issue was discovered on certain GL-iNet devices, including MT6000, MT3000, MT2500, AXT1800, and AX1800 4.6.2. The upload interface allows the uploading of arbitrary files to the device. Once the device executes the files, it can lead to information leakage, enabling complete control.CVE-2024-45262: An issue was discovered on certain GL-iNet devices, including MT6000, MT3000, MT2500, AXT1800, and AX1800 4.6.https://patchthecve.com/cve/CVE-2024-45262.htmlhttps://patchthecve.com/cve/CVE-2024-45262.htmlWed, 17 Jun 2026 07:53:52 +0000HIGH 8.8: An issue was discovered on certain GL-iNet devices, including MT6000, MT3000, MT2500, AXT1800, and AX1800 4.6.2. The params parameter in the call method of the /rpc endpoint is vulnerable to arbitrary directory traversal, which enables attackers to execute scripts under any path.CVE-2024-45261: An issue was discovered on certain GL-iNet devices, including MT6000, MT3000, MT2500, AXT1800, and AX1800 4.6.https://patchthecve.com/cve/CVE-2024-45261.htmlhttps://patchthecve.com/cve/CVE-2024-45261.htmlWed, 17 Jun 2026 07:53:52 +0000HIGH 8.0: An issue was discovered on certain GL-iNet devices, including MT6000, MT3000, MT2500, AXT1800, and AX1800 4.6.2. The SID generated for a specific user is not tied to that user itself, which allows other users to potentially use it for authentication. Once an attacker bypasses the application's autheCVE-2024-45260: An issue was discovered on certain GL-iNet devices, including MT6000, MT3000, MT2500, AXT1800, and AX1800 4.6.https://patchthecve.com/cve/CVE-2024-45260.htmlhttps://patchthecve.com/cve/CVE-2024-45260.htmlWed, 17 Jun 2026 07:53:52 +0000HIGH 8.0: An issue was discovered on certain GL-iNet devices, including MT6000, MT3000, MT2500, AXT1800, and AX1800 4.6.2. Users who belong to unauthorized groups can invoke any interface of the device, thereby gaining complete control over it.CVE-2024-45259: An issue was discovered on certain GL-iNet devices, including MT6000, MT3000, MT2500, AXT1800, and AX1800 4.6.https://patchthecve.com/cve/CVE-2024-45259.htmlhttps://patchthecve.com/cve/CVE-2024-45259.htmlWed, 17 Jun 2026 07:53:52 +0000MEDIUM 6.5: An issue was discovered on certain GL-iNet devices, including MT6000, MT3000, MT2500, AXT1800, and AX1800 4.6.2. By intercepting an HTTP request and changing the filename property in the download interface, any file on the device can be deleted.CVE-2024-39229: An issue in GL-iNet products AR750/AR750S/AR300M/AR300M16/MT300N-V2/B1300/MT1300/SFT1200/X750 v4.3.11, MT3000/https://patchthecve.com/cve/CVE-2024-39229.htmlhttps://patchthecve.com/cve/CVE-2024-39229.htmlWed, 17 Jun 2026 07:41:33 +0000MEDIUM 5.3: An issue in GL-iNet products AR750/AR750S/AR300M/AR300M16/MT300N-V2/B1300/MT1300/SFT1200/X750 v4.3.11, MT3000/MT2500/AXT1800/AX1800/A1300/X300B v4.5.16, XE300 v4.3.16, E750 v4.3.12, AP1300/S1300 v4.3.13, XE3000/X3000 v4, and B2200/MV1000/MV1000W/USB150/N300/SF1200 v3.216 allows attackers to intercepCVE-2024-39227: GL-iNet products AR750/AR750S/AR300M/AR300M16/MT300N-V2/B1300/MT1300/SFT1200/X750 v4.3.11, MT3000/MT2500/AXT18https://patchthecve.com/cve/CVE-2024-39227.htmlhttps://patchthecve.com/cve/CVE-2024-39227.htmlWed, 17 Jun 2026 07:41:33 +0000CRITICAL 9.8: GL-iNet products AR750/AR750S/AR300M/AR300M16/MT300N-V2/B1300/MT1300/SFT1200/X750 v4.3.11, MT3000/MT2500/AXT1800/AX1800/A1300/X300B v4.5.16, XE300 v4.3.16, E750 v4.3.12, AP1300/S1300 v4.3.13, and XE3000/X3000 v4.4 were discovered to contain insecure permissions in the endpoint /cgi-bin/glc. This vulCVE-2024-39228: GL-iNet products AR750/AR750S/AR300M/AR300M16/MT300N-V2/B1300/MT1300/SFT1200/X750 v4.3.11, MT3000/MT2500/AXT18https://patchthecve.com/cve/CVE-2024-39228.htmlhttps://patchthecve.com/cve/CVE-2024-39228.htmlWed, 17 Jun 2026 07:41:33 +0000CRITICAL 9.8: GL-iNet products AR750/AR750S/AR300M/AR300M16/MT300N-V2/B1300/MT1300/SFT1200/X750 v4.3.11, MT3000/MT2500/AXT1800/AX1800/A1300/X300B v4.5.16, XE300 v4.3.16, E750 v4.3.12, AP1300/S1300 v4.3.13, and XE3000/X3000 v4.4 were discovered to contain a shell injection vulnerability via the interface check_ovpCVE-2024-39226: GL-iNet products AR750/AR750S/AR300M/AR300M16/MT300N-V2/B1300/MT1300/SFT1200/X750 v4.3.11, MT3000/MT2500/AXT18https://patchthecve.com/cve/CVE-2024-39226.htmlhttps://patchthecve.com/cve/CVE-2024-39226.htmlWed, 17 Jun 2026 07:41:33 +0000CRITICAL 9.8: GL-iNet products AR750/AR750S/AR300M/AR300M16/MT300N-V2/B1300/MT1300/SFT1200/X750 v4.3.11, MT3000/MT2500/AXT1800/AX1800/A1300/X300B v4.5.16, XE300 v4.3.16, E750 v4.3.12, AP1300/S1300 v4.3.13, and XE3000/X3000 v4.4 were discovered to contain a vulnerability can be exploited to manipulate routers by pCVE-2024-39225: GL-iNet products AR750/AR750S/AR300M/AR300M16/MT300N-V2/B1300/MT1300/SFT1200/X750 v4.3.11, MT3000/MT2500/AXT18https://patchthecve.com/cve/CVE-2024-39225.htmlhttps://patchthecve.com/cve/CVE-2024-39225.htmlWed, 17 Jun 2026 07:41:32 +0000CRITICAL 9.8: GL-iNet products AR750/AR750S/AR300M/AR300M16/MT300N-V2/B1300/MT1300/SFT1200/X750 v4.3.11, MT3000/MT2500/AXT1800/AX1800/A1300/X300B v4.5.16, XE300 v4.3.16, E750 v4.3.12, AP1300/S1300 v4.3.13, and XE3000/X3000 v4.4 were discovered to contain a remote code execution (RCE) vulnerability.