CVE-2025-2850

Summary

A vulnerability was found in GL.iNet GL-A1300 Slate Plus, GL-AR300M16 Shadow, GL-AR300M Shadow, GL-AR750 Creta, GL-AR750S-EXT Slate, GL-AX1800 Flint, GL-AXT1800 Slate AX, GL-B1300 Convexa-B, GL-B3000 Marble, GL-BE3600 Slate 7, GL-E750, GL-E750V2 Mudi, GL-MT300N-V2 Mango, GL-MT1300 Beryl, GL-MT2500 Brume 2, GL-MT3000 Beryl AX, GL-MT6000 Flint 2, GL-SFT1200 Opal, GL-X300B Collie, GL-X750 Spitz, GL-X3000 Spitz AX, GL-XE300 Puli and GL-XE3000 Puli AX 4.x. It has been rated as problematic. This issue affects some unknown processing of the component Download Interface. The manipulation leads to improper authorization. It is recommended to upgrade the affected component.

Affected Software

VendorProductVersion RangeStatus
GL.iNetGL-A1300 Slate Plus4.xaffected
GL.iNetGL-AR300M16 Shadow4.xaffected
GL.iNetGL-AR300M Shadow4.xaffected
GL.iNetGL-AR750 Creta4.xaffected
GL.iNetGL-AR750S-EXT Slate4.xaffected
GL.iNetGL-AX1800 Flint4.xaffected
GL.iNetGL-AXT1800 Slate AX4.xaffected
GL.iNetGL-B1300 Convexa-B4.xaffected
GL.iNetGL-B3000 Marble4.xaffected
GL.iNetGL-BE3600 Slate 74.xaffected
GL.iNetGL-E7504.xaffected
GL.iNetGL-E750V2 Mudi4.xaffected
GL.iNetGL-MT300N-V2 Mango4.xaffected
GL.iNetGL-MT1300 Beryl4.xaffected
GL.iNetGL-MT2500 Brume 24.xaffected
GL.iNetGL-MT3000 Beryl AX4.xaffected
GL.iNetGL-MT6000 Flint 24.xaffected
GL.iNetGL-SFT1200 Opal4.xaffected
GL.iNetGL-X300B Collie4.xaffected
GL.iNetGL-X750 Spitz4.xaffected
GL.iNetGL-X3000 Spitz AX4.xaffected
GL.iNetGL-XE300 Puli4.xaffected
GL.iNetGL-XE3000 Puli AX4.xaffected

Weaknesses

  • CWE-285: Improper Authorization
  • CWE-266: Incorrect Privilege Assignment

ADP Enrichment

CISA ADP Vulnrichment

  • SSVC:
  • Exploitation: none
    • Automatable: no
    • Technical Impact: partial

References