The GL-Inet GL-AXT1800 is vulnerable to a firmware downgrade attack that could allow a remote adversary to compromise device integrity via a man-in-the-middle vector.

This vulnerability, classified as improper certificate validation (CWE-295), exists within the OTA update functionality. An unauthenticated attacker can perform a man-in-the-middle attack to inject a malicious .tar file, facilitating a firmware downgrade.

Successful exploitation of this flaw allows an attacker to downgrade the device firmware to a version with known, exploitable vulnerabilities, effectively bypassing existing security protections. Given the high CVSS score of 8.3, this risk is significant, as it could lead to full system compromise, persistent unauthorized access, and potential exfiltration of sensitive network traffic routed through the device.

Immediate Action: Contact GL-Inet support or monitor official vendor channels for the release of a patched firmware version that addresses the improper certificate validation in the OTA process.

Proactive Monitoring: Monitor network traffic for suspicious man-in-the-middle activity or unauthorized attempts to initiate firmware update processes.

Compensating Controls: Ensure the device is managed within a segmented network and avoid performing firmware updates over untrusted or public network connections.

Public Exploit Available: Unknown

The severity of this vulnerability necessitates immediate vigilance, as it effectively nullifies the security benefits of previously installed updates. Administrators should prioritize verifying the authenticity of firmware updates and apply the vendor-provided patch as soon as it becomes available to restore the integrity of the update mechanism.