CVE-2026-19980 is a code injection vulnerability affecting multiple GL.iNet router models up to firmware version 4.8.x. The issue resides in the ui.update_langs function within the Language Update component. By manipulating the hour, min, or week parameters, an attacker can remotely inject code. The vendor has acknowledged the vulnerability's existence but has not provided information on patches or mitigations. The CVSS 4.0 vector indicates network attack vector, low attack complexity, no privileges required, no user interaction, and low impacts across confidentiality, integrity, availability, and security scope.

Successful exploitation could allow remote code injection, potentially enabling attackers to execute arbitrary code on affected devices. The impact is rated medium based on the CVSS score of 5.3, reflecting limited but non-negligible risk to confidentiality, integrity, and availability. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or temporary workaround has been disclosed, users should monitor GL.iNet communications for updates. Until a patch is available, restricting remote access to the affected function and minimizing exposure of the device to untrusted networks may reduce risk.