Check Point Advisories

GL-iNet Multiple Products Remote Code Execution (CVE-2024-39225)

Vulnerability
Protection

Check Point Reference:	CPAI-2024-2591
Date Published:	2 Dec 2025
Severity:	Critical
Last Updated:	Tuesday 02 December, 2025
Source:
Industry Reference:	CVE-2024-39225
Protection Provided by:	Security Gateway R81, R80, R77, R75
Who is Vulnerable?	GL-iNet MT6000 4.5.8 GL-iNet A1300 4.5.16 GL-iNet X300B 4.5.16 GL-iNet AX1800 4.5.16 GL-iNet AXT1800 4.5.16 GL-iNet MT2500 4.5.16 GL-iNet MT3000 4.5.16 GL-iNet X3000 4.4.8 GL-iNet XE3000 4.4.8 GL-iNet XE300 4.3.16 GL-iNet E750 4.3.12 GL-iNet X750 4.3.11 GL-iNet SFT1200 4.3.11 GL-iNet AR300M 4.3.11 GL-iNet AR300M16 4.3.11 GL-iNet AR750 4.3.11 GL-iNet AR750S 4.3.11 GL-iNet B1300 4.3.11 GL-iNet MT1300 4.3.11 GL-iNet MT300N-V2 4.3.11 GL-iNet AP1300 3.217 GL-iNet B2200 3.216 GL-iNet MV1000 3.216 GL-iNet MV1000W 3.216 GL-iNet USB150 3.216 GL-iNet SF1200 3.216 GL-iNet N300 3.216 GL-iNet S1300 3.216
Vulnerability Description	A remote code execution vulnerability in GL-iNet Multiple Products allows attackers to execute arbitrary code by exploiting flaws in the affected firmware versions.

Protection Overview

This protection detects attempts to exploit this vulnerability.

In order for the protection to be activated, update your Security Gateway product to the latest IPS update. For information on how to update IPS, go to SBP-2006-05, click on Protection tab and select the version of your choice.

Security Gateway R81 / R80 / R77 / R75

In the IPS tab, click Protections and find the GL-iNet Multiple Products Remote Code Execution (CVE-2024-39225) protection using the Search tool and Edit the protection's settings.
Install policy on all Security Gateways.

This protection's log will contain the following information:

Attack Name: Application Servers Protection Violation.
Attack Information: GL-iNet Multiple Products Remote Code Execution (CVE-2024-39225)