PatchTheCVE: x300b firmwarehttps://patchthecve.com/CVEs with upgrade or downgrade fix stepsCVE-2024-45262: An issue was discovered on certain GL-iNet devices, including MT6000, MT3000, MT2500, AXT1800, and AX1800 4.6.https://patchthecve.com/cve/CVE-2024-45262.htmlhttps://patchthecve.com/cve/CVE-2024-45262.htmlWed, 17 Jun 2026 07:53:52 +0000HIGH 8.8: An issue was discovered on certain GL-iNet devices, including MT6000, MT3000, MT2500, AXT1800, and AX1800 4.6.2. The params parameter in the call method of the /rpc endpoint is vulnerable to arbitrary directory traversal, which enables attackers to execute scripts under any path.CVE-2024-45261: An issue was discovered on certain GL-iNet devices, including MT6000, MT3000, MT2500, AXT1800, and AX1800 4.6.https://patchthecve.com/cve/CVE-2024-45261.htmlhttps://patchthecve.com/cve/CVE-2024-45261.htmlWed, 17 Jun 2026 07:53:52 +0000HIGH 8.0: An issue was discovered on certain GL-iNet devices, including MT6000, MT3000, MT2500, AXT1800, and AX1800 4.6.2. The SID generated for a specific user is not tied to that user itself, which allows other users to potentially use it for authentication. Once an attacker bypasses the application's autheCVE-2024-39229: An issue in GL-iNet products AR750/AR750S/AR300M/AR300M16/MT300N-V2/B1300/MT1300/SFT1200/X750 v4.3.11, MT3000/https://patchthecve.com/cve/CVE-2024-39229.htmlhttps://patchthecve.com/cve/CVE-2024-39229.htmlWed, 17 Jun 2026 07:41:33 +0000MEDIUM 5.3: An issue in GL-iNet products AR750/AR750S/AR300M/AR300M16/MT300N-V2/B1300/MT1300/SFT1200/X750 v4.3.11, MT3000/MT2500/AXT1800/AX1800/A1300/X300B v4.5.16, XE300 v4.3.16, E750 v4.3.12, AP1300/S1300 v4.3.13, XE3000/X3000 v4, and B2200/MV1000/MV1000W/USB150/N300/SF1200 v3.216 allows attackers to intercepCVE-2024-39227: GL-iNet products AR750/AR750S/AR300M/AR300M16/MT300N-V2/B1300/MT1300/SFT1200/X750 v4.3.11, MT3000/MT2500/AXT18https://patchthecve.com/cve/CVE-2024-39227.htmlhttps://patchthecve.com/cve/CVE-2024-39227.htmlWed, 17 Jun 2026 07:41:33 +0000CRITICAL 9.8: GL-iNet products AR750/AR750S/AR300M/AR300M16/MT300N-V2/B1300/MT1300/SFT1200/X750 v4.3.11, MT3000/MT2500/AXT1800/AX1800/A1300/X300B v4.5.16, XE300 v4.3.16, E750 v4.3.12, AP1300/S1300 v4.3.13, and XE3000/X3000 v4.4 were discovered to contain insecure permissions in the endpoint /cgi-bin/glc. This vulCVE-2024-39228: GL-iNet products AR750/AR750S/AR300M/AR300M16/MT300N-V2/B1300/MT1300/SFT1200/X750 v4.3.11, MT3000/MT2500/AXT18https://patchthecve.com/cve/CVE-2024-39228.htmlhttps://patchthecve.com/cve/CVE-2024-39228.htmlWed, 17 Jun 2026 07:41:33 +0000CRITICAL 9.8: GL-iNet products AR750/AR750S/AR300M/AR300M16/MT300N-V2/B1300/MT1300/SFT1200/X750 v4.3.11, MT3000/MT2500/AXT1800/AX1800/A1300/X300B v4.5.16, XE300 v4.3.16, E750 v4.3.12, AP1300/S1300 v4.3.13, and XE3000/X3000 v4.4 were discovered to contain a shell injection vulnerability via the interface check_ovpCVE-2024-39226: GL-iNet products AR750/AR750S/AR300M/AR300M16/MT300N-V2/B1300/MT1300/SFT1200/X750 v4.3.11, MT3000/MT2500/AXT18https://patchthecve.com/cve/CVE-2024-39226.htmlhttps://patchthecve.com/cve/CVE-2024-39226.htmlWed, 17 Jun 2026 07:41:33 +0000CRITICAL 9.8: GL-iNet products AR750/AR750S/AR300M/AR300M16/MT300N-V2/B1300/MT1300/SFT1200/X750 v4.3.11, MT3000/MT2500/AXT1800/AX1800/A1300/X300B v4.5.16, XE300 v4.3.16, E750 v4.3.12, AP1300/S1300 v4.3.13, and XE3000/X3000 v4.4 were discovered to contain a vulnerability can be exploited to manipulate routers by pCVE-2024-39225: GL-iNet products AR750/AR750S/AR300M/AR300M16/MT300N-V2/B1300/MT1300/SFT1200/X750 v4.3.11, MT3000/MT2500/AXT18https://patchthecve.com/cve/CVE-2024-39225.htmlhttps://patchthecve.com/cve/CVE-2024-39225.htmlWed, 17 Jun 2026 07:41:32 +0000CRITICAL 9.8: GL-iNet products AR750/AR750S/AR300M/AR300M16/MT300N-V2/B1300/MT1300/SFT1200/X750 v4.3.11, MT3000/MT2500/AXT1800/AX1800/A1300/X300B v4.5.16, XE300 v4.3.16, E750 v4.3.12, AP1300/S1300 v4.3.13, and XE3000/X3000 v4.4 were discovered to contain a remote code execution (RCE) vulnerability.