Travel router

GL.iNet GL-AR150

Projects for this device

Replacement firmware

OpenWrt

Replace router software with a customizable system for network controls and community packages.

How to get started

Follow the guide for your exact router version. The first installation may use its web interface, recovery mode or a serial connection.

Setup: Firmware replacement; route varies by router
You’ll need: Exact hardware revision, an appropriate OpenWrt release and its model-specific installation guide.

Hardware revision not specified: Get OpenWrt firmware Release listed · 25.12.6
Hardware revision not specified: Get firmware Release listed · 25.12.5
Hardware revision not specified: Open hardware record Release listed · 25.12.5

Original project github.com

Recorded configuration: 16 MB flash; 64 MB RAM

First installation: GUI OEM; U-Boot USB recovery; U-Boot web recovery

Sources

Features & details

Check the project and hardware shown for each feature.

OpenWrt

OpenWrt — Source documentation (openwrt.org)

Installation routes recorded: GUI OEM, U-Boot USB recovery, U-Boot web recovery
Recovery routes recorded: U-Boot USB recovery, U-Boot web recovery
Availability recorded by source: Discontinued 2023

Hardware details

Documented hardware

gl.inet gl-ar150 — device documentation (github.com)GL.iNet GL-AR150 — TechInfoDepot (github.com)Documented hardware — Source documentation (openwrt.org)

Processor: Atheros AR9331
Flash: 16 MB
Processor / Wi-Fi: Atheros AR9331
Memory: 64 MB

Technical references

GL.iNet GL-AR150 — WikiDevi hardware record (github.com) ↗

Security

Saved scan 18 Oct 2026

From our saved security research.

Model advisories

Selected highlights

Prioritized by known exploitation, severity, then date.

CVE published 7 Dec 2021

GL.iNet GL-AR150

GL.iNet GL-AR150 2.x before 3.x devices, configured as repeaters, allow cgi-bin/router_cgi?action=scanwifi XSS when an attacker creates an SSID with an XSS payload as the name.

CVE-2021-44148

Affected firmware: GL-AR150: 2.x before 3.x
Fix: Fix details in the linked record

Read mitre CVE record

Details and sources

CVE updated 4 Aug 2024

GL.iNet GL-AR150 2.x before 3.x devices, configured as repeaters, allow cgi-bin/router_cgi?action=scanwifi XSS when an attacker creates an SSID with an XSS payload as the name.

CVE-2021-44148 record (beaugraham.com) ↗

Check more security advisories for this device · CVE.org