CVE-2024-45263 Overview
CVE-2024-45263 is an arbitrary file upload vulnerability affecting multiple GL-iNet router models, including the MT6000, MT3000, MT2500, AXT1800, and AX1800 running firmware 4.6.2. The upload interface accepts arbitrary files without proper validation. Once the device executes an uploaded file, an attacker can achieve information disclosure and complete device control. The flaw is tracked under CWE-434: Unrestricted Upload of File with Dangerous Type. Exploitation requires adjacent-network access to the device management interface. GL-iNet published details in its CVE-issues repository.
Critical Impact
Successful exploitation grants an adjacent attacker complete control over the router, including the ability to intercept traffic, pivot into internal networks, and modify firmware.
Affected Products
- GL-iNet MT6000, MT3000, MT2500, AXT1800, AX1800 firmware 4.6.2
- GL-iNet B3000, A1300, X300B, X3000, XE3000 firmware branches
- GL-iNet X750, SFT1200, MT1300, E750, XE300, AR750, AR750S, AR300M, AR300M16, B1300, MT300N-V2 firmware branches
Discovery Timeline
- 2024-10-24 - CVE-2024-45263 published to NVD
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2024-45263
Vulnerability Analysis
The vulnerability resides in the OpenVPN configuration upload interface (ovpn_upload) exposed by the GL-iNet router web administration service. The endpoint accepts file uploads without enforcing type, extension, or content validation. An attacker on an adjacent network can submit an arbitrary payload rather than a legitimate .ovpn configuration file.
Because the device subsequently processes and executes uploaded content, the flaw escalates from a file-write primitive to full command execution in the router context. Router services typically run with elevated privileges, so a successful upload results in complete compromise of the embedded Linux environment.
Root Cause
The root cause is the absence of server-side validation in the ovpn_upload handler. The interface neither enforces an allow-list of file types nor validates uploaded content structure before writing it to disk and passing it to downstream execution logic. This maps directly to CWE-434.
Attack Vector
Exploitation requires adjacent-network access, meaning the attacker must reach the router's management interface over the LAN, Wi-Fi, or a VPN segment. No authentication or user interaction is required. The attacker submits a crafted multipart file upload to the vulnerable endpoint. Once written, the payload is executed by the device, yielding shell-level control. See the GL-iNet advisory for endpoint specifics.
Detection Methods for CVE-2024-45263
Indicators of Compromise
- Unexpected HTTP POST requests to the ovpn_upload endpoint on the router management interface
- New or modified files in OpenVPN configuration directories that do not match legitimate .ovpn structure
- Unusual outbound connections from the router to attacker-controlled infrastructure
- Unknown processes, cron entries, or startup scripts on the device
Detection Strategies
- Inspect router web-service access logs for POST requests to upload endpoints from unexpected client IPs
- Compare running firmware, configuration files, and installed packages against a known-good baseline
- Monitor DNS and NetFlow telemetry for the router IP to identify unexpected command-and-control traffic
Monitoring Recommendations
- Forward router syslog and authentication events to a centralized SIEM for correlation
- Alert on management-interface access originating from untrusted VLANs or guest Wi-Fi segments
- Baseline outbound connections from network infrastructure devices and flag deviations
How to Mitigate CVE-2024-45263
Immediate Actions Required
- Restrict access to the GL-iNet web administration interface to trusted management VLANs only
- Disable remote administration and any exposed VPN upload functionality until patched firmware is applied
- Rotate administrative credentials and any VPN keys previously handled by the router
- Audit affected devices for signs of compromise before returning them to production use
Patch Information
GL-iNet tracks affected firmware branches in its CVE-issues repository. Administrators should update each affected model to the latest firmware release published by the vendor. Verify firmware integrity using the vendor-provided checksums after upgrade.
Workarounds
- Segment routers onto a dedicated management network unreachable from user or guest devices
- Enforce firewall rules that block access to the router web interface from Wi-Fi client subnets
- Where possible, disable the OpenVPN client upload feature until the firmware is updated
- Monitor vendor advisories and subscribe to GL-iNet security notifications for follow-up patches
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
