CVE-2024-28077 Overview
CVE-2024-28077 is a denial-of-service vulnerability affecting a wide range of GL-iNet routers and travel routers. The flaw resides in the device login interface, where specially crafted usernames containing special characters such as half parentheses or square brackets can crash the session-management process. Once crashed, legitimate users are unable to log into the device until the session manager is restored.
The issue is amplified by GL-iNet's Dynamic DNS (DDNS) feature. Public services can enumerate exposed devices through DDNS records, revealing their IP addresses and ports to unauthenticated remote attackers.
Critical Impact
Unauthenticated remote attackers can crash the login interface across 19 affected GL-iNet device models, locking administrators out of router management.
Affected Products
- GL-iNet MT6000 (4.5.6), XE3000 (4.4.5), X3000 (4.4.6)
- GL-iNet MT3000, MT2500, AXT1800, AX1800, A1300 (all 4.5.0)
- GL-iNet S200 (4.1.4-0300), X750/SFT1200 (4.3.7), XE300 (4.3.16), and AR/B/MT-series devices on firmware 4.3.10
Discovery Timeline
- 2024-08-26 - CVE-2024-28077 published to NVD
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2024-28077
Vulnerability Analysis
The vulnerability is a remote denial-of-service condition in the authentication path of GL-iNet's web management interface. The login endpoint accepts arbitrary username input and forwards it to the session-management subsystem. When the username contains specific special characters such as (, ), [, or ], the session manager fails to handle the input safely and crashes.
Because the session-management process is required to issue and validate authentication tokens, its crash blocks all subsequent login attempts. Administrators lose access to the device's web UI until the service or the device itself is restarted. The vulnerability requires no authentication, no user interaction, and is exploitable over the network.
Root Cause
The root cause is improper input validation on the username parameter submitted to the login interface. The session-management daemon does not sanitize or escape unexpected punctuation characters, which leads to an unhandled exception or process termination. The CWE classification is currently listed as NVD-CWE-noinfo.
Attack Vector
Attackers locate exposed GL-iNet devices through public DDNS enumeration services that index hostnames assigned by GL-iNet's DDNS infrastructure. After obtaining the IP and management port, the attacker issues an HTTP request to the login endpoint with a malformed username string. Repeated requests keep the session manager unavailable, producing a sustained denial-of-service condition.
No public exploit code is currently indexed in Exploit-DB, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. Technical details are described in the GL-iNet CVE-issues repository on GitHub.
Detection Methods for CVE-2024-28077
Indicators of Compromise
- Repeated failed POST requests to the device login endpoint containing usernames with (, ), [, or ] characters.
- Sudden unavailability of the GL-iNet web management UI while the device otherwise routes traffic normally.
- Crash entries or restart events for the session-management daemon in device logs.
Detection Strategies
- Inspect router access logs for malformed username values submitted to /cgi-bin/ login handlers or the LuCI authentication endpoint.
- Alert on repeated 5xx responses or connection resets returned by the management interface following login attempts.
- Correlate DDNS hostname lookups from untrusted sources with subsequent inbound HTTP requests to the management port.
Monitoring Recommendations
- Forward router syslog data to a central log platform and monitor for session-manager restart loops.
- Track external scanning activity targeting GL-iNet DDNS hostnames or default management ports.
- Baseline normal administrator login patterns and alert on anomalous authentication request rates.
How to Mitigate CVE-2024-28077
Immediate Actions Required
- Update affected GL-iNet devices to firmware versions released after the listed vulnerable builds as soon as GL-iNet publishes a fix.
- Disable DDNS on internet-exposed devices unless explicitly required for remote management.
- Restrict access to the web management interface to trusted LAN segments or VPN clients only.
Patch Information
GL-iNet tracks this issue in its public CVE-issues repository. Administrators should consult the GL-iNet official website for the latest firmware release notes corresponding to their device model and apply the most recent stable firmware that addresses CVE-2024-28077.
Workarounds
- Block inbound traffic to the router's HTTP/HTTPS management ports at the WAN interface using firewall rules.
- Remove the device's DDNS hostname registration to reduce discoverability from public DDNS enumeration services.
- Place the management interface behind a WireGuard or OpenVPN tunnel, both of which are natively supported by GL-iNet firmware.
# Example: disable WAN access to the web UI via UCI on GL-iNet (OpenWrt-based) firmware
uci set firewall.@zone[1].input='DROP'
uci add firewall rule
uci set firewall.@rule[-1].name='Block-WAN-Admin'
uci set firewall.@rule[-1].src='wan'
uci set firewall.@rule[-1].dest_port='80 443'
uci set firewall.@rule[-1].target='DROP'
uci commit firewall
/etc/init.d/firewall restart
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
