CVE-2024-45260

Executive Summary

CVE-2024-45260 is a critical authorization bypass vulnerability affecting multiple GL.iNet router models, including MT6000, MT3000, MT2500, AXT1800, and AX1800, running firmware version 4.6.2. The flaw allows users belonging to unauthorized groups to invoke any interface of the device, effectively granting them complete administrative control. This vulnerability stems from improper authorization checks (CWE-285) in the device's web interface or API, enabling privilege escalation from a low-privileged user to full root-level access. With a CVSS score of 0.0 (likely a placeholder, but the vector indicates high severity), the threat is significant due to the widespread use of these routers in home and small business environments. No official patch has been released, and exploitation is publicly known, making immediate mitigation critical.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
• Base Score: 0.0 (placeholder; actual severity is high based on vector)
• Attack Vector: Network (AV:N) – exploitable remotely.
• Attack Complexity: Low (AC:L) – no special conditions required.
• Privileges Required: Low (PR:L) – attacker needs a valid low-privileged account.
• User Interaction: None (UI:N) – no user action needed.
• Scope: Unchanged (S:U) – vulnerability affects only the device.
• Confidentiality Impact: High (C:H) – full data access.
• Integrity Impact: High (I:H) – full control over device configuration.
• Availability Impact: High (A:H) – potential denial of service or device takeover.
• Threat Level: Critical – due to low attack complexity and high impact, combined with no patch available.

Deep Dive & Mechanics

The vulnerability lies in the authorization mechanism of GL.iNet routers running firmware 4.6.2. The device exposes multiple interfaces (likely REST APIs or web endpoints) for configuration and management. These interfaces are intended to be restricted to users with specific roles (e.g., admin). However, due to improper validation of user group membership, any authenticated user—even those in unauthorized groups—can access and invoke these interfaces. This bypasses role-based access control (RBAC), allowing an attacker to execute administrative actions such as modifying firewall rules, changing passwords, exfiltrating data, or installing malware.

The root cause is a missing or flawed check in the backend code that verifies user permissions before processing API requests. For example, the code might check if a user is authenticated but fail to verify if they belong to the "admin" group. This is a classic CWE-285 (Improper Authorization) issue.

Vulnerable vs. Patched Code

Since no patch is available, the following is a hypothetical comparison based on typical authorization bypass vulnerabilities.

Vulnerable Code (Python/Flask example):

@app.route('/api/reboot', methods=['POST'])
@login_required
def reboot_device():
    # Missing authorization check
    os.system('reboot')
    return jsonify({'status': 'success'})

Patched Code (Hypothetical):

@app.route('/api/reboot', methods=['POST'])
@login_required
@admin_required  # Custom decorator to check group membership
def reboot_device():
    os.system('reboot')
    return jsonify({'status': 'success'})

The admin_required decorator would verify that the authenticated user belongs to the "admin" group before allowing access.

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• A GL.iNet device (e.g., MT6000) running firmware 4.6.2.
• A low-privileged user account (e.g., "guest" or "user").
• Network access to the device's web interface or API.

Exploitation Steps:

1. Authenticate as a low-privileged user (e.g., using default credentials or brute-forcing).
2. Identify the vulnerable API endpoints (e.g., /api/reboot, /api/set_admin_password).
3. Send a request to an administrative endpoint without proper authorization.

Example using curl:

# Authenticate and get session cookie
curl -c cookies.txt -X POST http://192.168.1.1/login -d "username=guest&password=guest"

# Exploit: reboot the device (should require admin)
curl -b cookies.txt -X POST http://192.168.1.1/api/reboot

Expected Result: The device reboots, confirming unauthorized access.

Blue Team (Detection & Defense)

Detection:

• Monitor for unusual API calls from low-privileged users.
• Look for patterns of repeated authentication attempts followed by administrative actions.
• Use the detection rules provided in the Detection Engineering section.

Defense:

• Immediately restrict network access to the device's management interface.
• Implement network segmentation to isolate the router.
• Monitor logs for unauthorized access attempts.
• Apply vendor patches as soon as they become available.

Indicators of Compromise (IOCs)

• Network IOCs:
  • Unusual API calls to endpoints like /api/reboot, /api/set_admin_password, /api/firewall from non-admin users.
  • Multiple failed login attempts followed by successful administrative actions.
• Host IOCs:
  • Unexpected changes to device configuration (e.g., firewall rules, DNS settings).
  • New user accounts with admin privileges.
  • Unusual outbound connections from the device.
• Log IOCs:
  • Log entries showing access to administrative interfaces by users with "user" or "guest" roles.

Detection Engineering

YARA Rule

rule CVE_2024_45260_GLiNet_AuthBypass {
    meta:
        description = "Detects exploitation attempts of CVE-2024-45260 on GL.iNet devices"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2024-45260"
    strings:
        $api_endpoint = "/api/" ascii wide nocase
        $admin_action = "reboot" or "set_admin_password" or "firewall" ascii wide nocase
        $unauthorized_user = "guest" or "user" ascii wide nocase
    condition:
        $api_endpoint and $admin_action and $unauthorized_user
}

Sigma Rule

title: GL.iNet CVE-2024-45260 Authorization Bypass
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects unauthorized access to administrative API endpoints on GL.iNet devices
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: glinet
detection:
    selection:
        http_method: 'POST'
        url_path|contains: '/api/'
        user_agent|contains: 'curl' or 'python-requests'
    condition: selection
falsepositives:
    - Legitimate admin actions
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2024-45260 GL.iNet Authorization Bypass Attempt"; flow:to_server,established; content:"POST"; http_method; content:"/api/"; http_uri; content:"reboot" or content:"set_admin_password" or content:"firewall"; http_uri; classtype:attempted-admin; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable remote management if not required.
2. Change default credentials for all user accounts.
3. Restrict access to the management interface to trusted IP addresses only.
4. Monitor logs for suspicious activity.

Long-term Fix:

• Apply vendor patch when released (currently UNKNOWN).
• Consider replacing the device if no patch is provided.
• Implement network segmentation to isolate IoT devices.

Workaround:

• Use a firewall to block access to the device's web interface from untrusted networks.
• Disable guest accounts if not needed.

Valters IT