Filtered by vendor Gl-inet Subscriptions
Filtered by product Gl-ar300m16 Subscriptions
Total 6 CVE
CVE Vendors Products Updated CVSS v3.1
CVE-2026-26795 1 Gl-inet 3 Ar300m16, Ar300m16 Firmware, Gl-ar300m16 2026-03-14 9.8 Critical
GL-iNet GL-AR300M16 v4.3.11 was discovered to contain a command injection vulnerability via the module parameter in the M.get_system_log function. This vulnerability allows attackers to execute arbitrary commands via a crafted input.
CVE-2026-26794 1 Gl-inet 3 Ar300m16, Ar300m16 Firmware, Gl-ar300m16 2026-03-14 8.8 High
GL-iNet GL-AR300M16 v4.3.11 was discovered to contain a SQL injection vulnerability via the add_group() function. This vulnerability allows attackers to execute arbitrary SQL database operations via a crafted HTTP request.
CVE-2026-26792 1 Gl-inet 3 Ar300m16, Ar300m16 Firmware, Gl-ar300m16 2026-03-14 9.8 Critical
GL-iNet GL-AR300M16 v4.3.11 was discovered to contain multiple command injection vulnerabilities in the set_upgrade function via the modem_url, target_version, current_version, firmware_upload, hash_type, hash_value, and upgrade_type parameters. These vulnerabilities allow attackers to execute arbitrary commands via a crafted input.
CVE-2026-26791 1 Gl-inet 3 Ar300m16, Ar300m16 Firmware, Gl-ar300m16 2026-03-14 9.8 Critical
GL-iNet GL-AR300M16 v4.3.11 was discovered to contain a command injection vulnerability via the string port parameter in the enable_echo_server function. This vulnerability allows attackers to execute arbitrary commands via a crafted input.
CVE-2026-26793 1 Gl-inet 3 Ar300m16, Ar300m16 Firmware, Gl-ar300m16 2026-03-13 9.8 Critical
GL-iNet GL-AR300M16 v4.3.11 was discovered to contain a command injection vulnerability via the set_config function. This vulnerability allows attackers to execute arbitrary commands via a crafted input.
CVE-2024-39227 1 Gl-inet 77 A1300, A1300 Firmware, Ap1300 and 74 more 2024-08-15 9.8 Critical
GL-iNet products AR750/AR750S/AR300M/AR300M16/MT300N-V2/B1300/MT1300/SFT1200/X750 v4.3.11, MT3000/MT2500/AXT1800/AX1800/A1300/X300B v4.5.16, XE300 v4.3.16, E750 v4.3.12, AP1300/S1300 v4.3.13, and XE3000/X3000 v4.4 were discovered to contain insecure permissions in the endpoint /cgi-bin/glc. This vulnerability allows unauthenticated attackers to execute arbitrary code or possibly a directory traversal via crafted JSON data.