CVE-2025-2850 is an improper authorization vulnerability affecting the Download Interface of numerous GL.iNet router models running firmware version 4.x. This low-severity vulnerability (CVSS 3.5) could allow an authenticated attacker on the local network to gain unauthorized access to information, but does not impact integrity or availability. There is currently no public exploit code available, no evidence of active exploitation, and minimal community discussion or media coverage.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
| GL.INet | GL-A1300 Slate Plus | 4.xCNA affected | |
| GL.INet | GL-AR300M Shadow | 4.xCNA affected | |
| GL.INet | GL-AR300M16 Shadow | 4.xCNA affected | |
| GL.INet | GL-AR750 Creta | 4.xCNA affected | |
| GL.INet | GL-AR750S-EXT Slate | 4.xCNA affected |
CVSS version used by this source: 4.0
CVSS:4.0/AV:A/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
The average CVE in this peer group has 0.0 Twitter, 0.0 Reddit, 0.0 Bluesky, 0.0 Mastodon, and 0.0 GitHub mentions.
No media coverage found for this CVE.
The average CVE in this peer group has 0.1 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.
Remediation records are not available for this CVE.