This vulnerability affects GL.iNet routers including models A1300, AX1800, AXT1800, BE1400, BE3600, BE6500, BE9300, BE10000, E5800, MT2500, MT3000, MT3600BE, MT5000, MT6000, X2000, X3000, and XE3000 running firmware versions up to and including 4.8.x. The issue resides in the WebDAV Service's COPY/MOVE functionality, which can be manipulated remotely to bypass authorization mechanisms. The vendor has acknowledged the vulnerability after investigation. No official patch or remediation level has been published yet. The CVSS 4.0 vector indicates network attack vector, low attack complexity, no privileges or user interaction required, and low to limited impacts on confidentiality, integrity, availability, and security requirements.

Successful exploitation allows remote attackers to bypass authorization controls on the affected devices via the WebDAV Service's COPY/MOVE functions. This could potentially enable unauthorized access or manipulation of files or configurations accessible through WebDAV. The impact is rated medium severity based on the CVSS 4.0 score of 6.9.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider disabling the WebDAV Service if not required or restrict access to trusted networks to reduce exposure. Monitor vendor communications for updates on patches or official mitigations.