Read the docs
TI-2025-02489 Aliases CVE-2025-2851GHSA-4pmj-f9rj-vppc

GL.iNet GL-A1300 Slate Plus RPC plugins.so buffer overflow

Priority LOW 39CWE-119Published · Updated

Key facts

Attack vector
Adjacent network
Privileges required
Low
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
Code execution
Confidentiality · integrity · availability
High · High · High
Fix status
No fix listed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-119 and the CVSS impact.

Summary

A vulnerability classified as critical has been found in GL.iNet GL-A1300 Slate Plus, GL-AR300M16 Shadow, GL-AR300M Shadow, GL-AR750 Creta, GL-AR750S-EXT Slate, GL-AX1800 Flint, GL-AXT1800 Slate AX, GL-B1300 Convexa-B, GL-B3000 Marble, GL-BE3600 Slate 7, GL-E750, GL-E750V2 Mudi, GL-MT300N-V2 Mango, GL-MT1300 Beryl, GL-MT2500 Brume 2, GL-MT3000 Beryl AX, GL-MT6000 Flint 2, GL-SFT1200 Opal, GL-X300B Collie, GL-X750 Spitz, GL-X3000 Spitz AX, GL-XE300 Puli and GL-XE3000 Puli AX 4.x. Affected is an unknown function of the file plugins.so of the component RPC Handler. The manipulation leads to buffer overflow. It is recommended to upgrade the affected component.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00404 34th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
GL.iNetGL-A1300 Slate Plus4.x—No fix listedCNA
GL.iNetGL-AR300M16 Shadow4.x—No fix listedCNA
GL.iNetGL-AR300M Shadow4.x—No fix listedCNA
GL.iNetGL-AR750 Creta4.x—No fix listedCNA
GL.iNetGL-AR750S-EXT Slate4.x—No fix listedCNA
GL.iNetGL-AX1800 Flint4.x—No fix listedCNA
GL.iNetGL-AXT1800 Slate AX4.x—No fix listedCNA
GL.iNetGL-B1300 Convexa-B4.x—No fix listedCNA
GL.iNetGL-B3000 Marble4.x—No fix listedCNA
GL.iNetGL-BE3600 Slate 74.x—No fix listedCNA
GL.iNetGL-E7504.x—No fix listedCNA
GL.iNetGL-E750V2 Mudi4.x—No fix listedCNA
GL.iNetGL-MT300N-V2 Mango4.x—No fix listedCNA
GL.iNetGL-MT1300 Beryl4.x—No fix listedCNA
GL.iNetGL-MT2500 Brume 24.x—No fix listedCNA
GL.iNetGL-MT3000 Beryl AX4.x—No fix listedCNA
GL.iNetGL-MT6000 Flint 24.x—No fix listedCNA
GL.iNetGL-SFT1200 Opal4.x—No fix listedCNA
GL.iNetGL-X300B Collie4.x—No fix listedCNA
GL.iNetGL-X750 Spitz4.x—No fix listedCNA
GL.iNetGL-X3000 Spitz AX4.x—No fix listedCNA
GL.iNetGL-XE300 Puli4.x—No fix listedCNA
GL.iNetGL-XE3000 Puli AX4.x—No fix listedCNA
  • GL-A1300 Slate Plus VendorGL.iNet Affected 4.x Fixed in — No fix listed CNA
  • GL-AR300M16 Shadow VendorGL.iNet Affected 4.x Fixed in — No fix listed CNA
  • GL-AR300M Shadow VendorGL.iNet Affected 4.x Fixed in — No fix listed CNA
  • GL-AR750 Creta VendorGL.iNet Affected 4.x Fixed in — No fix listed CNA
  • GL-AR750S-EXT Slate VendorGL.iNet Affected 4.x Fixed in — No fix listed CNA
  • GL-AX1800 Flint VendorGL.iNet Affected 4.x Fixed in — No fix listed CNA
  • GL-AXT1800 Slate AX VendorGL.iNet Affected 4.x Fixed in — No fix listed CNA
  • GL-B1300 Convexa-B VendorGL.iNet Affected 4.x Fixed in — No fix listed CNA
  • GL-B3000 Marble VendorGL.iNet Affected 4.x Fixed in — No fix listed CNA
  • GL-BE3600 Slate 7 VendorGL.iNet Affected 4.x Fixed in — No fix listed CNA
  • GL-E750 VendorGL.iNet Affected 4.x Fixed in — No fix listed CNA
  • GL-E750V2 Mudi VendorGL.iNet Affected 4.x Fixed in — No fix listed CNA
  • GL-MT300N-V2 Mango VendorGL.iNet Affected 4.x Fixed in — No fix listed CNA
  • GL-MT1300 Beryl VendorGL.iNet Affected 4.x Fixed in — No fix listed CNA
  • GL-MT2500 Brume 2 VendorGL.iNet Affected 4.x Fixed in — No fix listed CNA
  • GL-MT3000 Beryl AX VendorGL.iNet Affected 4.x Fixed in — No fix listed CNA
  • GL-MT6000 Flint 2 VendorGL.iNet Affected 4.x Fixed in — No fix listed CNA
  • GL-SFT1200 Opal VendorGL.iNet Affected 4.x Fixed in — No fix listed CNA
  • GL-X300B Collie VendorGL.iNet Affected 4.x Fixed in — No fix listed CNA
  • GL-X750 Spitz VendorGL.iNet Affected 4.x Fixed in — No fix listed CNA
  • GL-X3000 Spitz AX VendorGL.iNet Affected 4.x Fixed in — No fix listed CNA
  • GL-XE300 Puli VendorGL.iNet Affected 4.x Fixed in — No fix listed CNA
  • GL-XE3000 Puli AX VendorGL.iNet Affected 4.x Fixed in — No fix listed CNA

Remediation

No fixed version listed by the sources yet.

Timeline

  1. 2026-10-02 Threatist record created from CVE-2025-2851
  2. 2026-10-03 Alias added: GHSA-4pmj-f9rj-vppc

References

Patch 1

  • TI-2026-21387 GL-iNet GL-AR300M16 v4.3.11 was discovered to contain a command injection vulnerability… CVSS 3.1CRITICAL 9.8
  • TI-2024-26219 GL-iNet products AR750/AR750S/AR300M/AR300M16/MT300N-V2/B1300/MT1300/SFT1200/X750… CVSS 3.1CRITICAL 9.8
  • TI-2023-27815 An issue was discovered on GL.iNet devices before version 4.5.0. CVSS 3.1CRITICAL 9.8
  • TI-2023-15082 An issue was discovered on GL.iNet devices before 3.216. CVSS 3.1CRITICAL 9.8
  • TI-2023-14015 GL.iNET MT3000 4.1.0 Release 2 is vulnerable to OS Command Injection via /usr/lib/oui-httpd/rpc/logread. CVSS 3.1CRITICAL 9.8
  • TI-2026-15312 GL.iNet GL-MT3000 nas-web RPC Wrapper glc nas-web.add_user command injection CVSS 4.0CRITICAL 9.3
See all 92 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences