CVE-2026-19983 is an OS command injection vulnerability in the NAS Command Service component of GL.iNet devices including A1300, AX1800, AXT1800, MT2500, MT3000, MT6000, X3000, and XE3000 running firmware version 4.8.x. The vulnerability arises from unsafe processing of the /usr/bin/gl_nas_sys file, allowing remote attackers to execute arbitrary OS commands. The vendor has confirmed the existence of this vulnerability and recommends upgrading to version 4.9.0 to address the issue.
A security vulnerability has been detected in GL.iNet BE9300 and MT6000 4.8.x. This vulnerability affects unknown code of the component Firewall-management RPC. The manipulation of the argument dest_port/dest_ip leads to os command injection. The attack may be initiated remotely. Upgrading to version 4.9.0 is able to resolve this issue. The affected component should be upgraded. The vendor explains: "After our investigation, we have confirmed that the vulnerability described (...) does indeed exist."
CVE-2026-19981 is an OS command injection vulnerability affecting multiple GL.iNet router models up to firmware version 4.8.x. The flaw exists in the Wi-Fi Timer Power-Schedule feature, where manipulation of the switch_power or restore_power arguments can lead to remote command execution. The vendor has confirmed the vulnerability's existence. The CVSS 4.0 score is 5.3, indicating medium severity. No official patch or remediation guidance has been provided yet.
A security flaw has been discovered in GL.iNet A1300, AX1800, AXT1800, BE1400, BE3600, BE6500, BE9300, BE10000, E5800, MT2500, MT3000, MT3600BE, MT5000, MT6000, X2000, X3000 and XE3000 up to 4.8.x. Affected by this issue is the function ui.update_langs of the component Language Update. Performing a manipulation of the argument hour/min/week results in code injection. The attack can be initiated remotely. The vendor explains: "After our investigation, we have confirmed that the vulnerability described (...) does indeed exist."
A vulnerability was identified in GL.iNet A1300, AX1800, AXT1800, BE1400, BE3600, BE6500, BE9300, BE10000, E5800, MT2500, MT3000, MT3600BE, MT5000, MT6000, X2000, X3000 and XE3000 up to 4.8.x. Affected by this vulnerability is the function COPY/MOVE of the component WebDAV Service. Such manipulation leads to authorization bypass. It is possible to launch the attack remotely. The vendor explains: "After our investigation, we have confirmed that the vulnerability described (...) does indeed exist."
CVE-2026-18787 is a command injection vulnerability in the GL.iNet AX1800 router firmware up to version 4.8.3. It affects the remove_rule function in the /usr/share/gl-ngx/oui-rpc.lua file within the RPC Endpoint component. The vulnerability allows remote attackers to manipulate the args.id argument to execute arbitrary commands. Exploit code is publicly available, but no known active exploitation has been reported. The vendor was notified early, but no official patch or remediation has been confirmed yet.
CVE-2026-18686 is a critical command injection vulnerability in the GL.iNet GL-MT3000 device affecting versions 4.4.0 through 4.4.5. The flaw exists in the nas-web.add_user function within the /cgi-bin/glc component, allowing remote attackers to execute arbitrary commands. Exploit code is publicly available, increasing the risk of exploitation. The vendor has confirmed the vulnerability but no official patch or remediation guidance is currently provided.
A critical command injection vulnerability exists in the GL.iNet GL-MT3000 router models up to version 4.4.5. The flaw is located in the set_upgrade function within the /cgi-bin/glc script of the modem.so component. This vulnerability allows remote attackers to execute arbitrary commands without any authentication or user interaction. The vulnerability has been publicly disclosed and confirmed by the vendor, but no official patch or remediation guidance has been provided yet.
CVE-2026-18684 is a critical command injection vulnerability in the GL.iNet GL-MT3000 device affecting versions 4.4.0 through 4.4.5. The flaw exists in the remove_profile function within the /cgi-bin/glc script of the modem.so component. This vulnerability allows remote attackers to execute arbitrary commands without authentication. The vendor has confirmed the issue, but no official patch or remediation guidance has been provided yet. Public exploit code is available, increasing the risk of exploitation.
A vulnerability was determined in GL.iNet GL-MT3000 up to 4.4.5. Affected is the function ovpn-client.get_recommend_config of the file /cgi-bin/glc of the component ovpn-client.so Native Plugin. Executing a manipulation of the argument Hostname can lead to command injection. The attack can be executed remotely. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure and confirmed the existence of the vulnerability.
A vulnerability was found in GL.iNet GL-MT3000 up to 4.4.5. This impacts the function ovpn-client.check_config of the file /cgi-bin/glc of the component ovpn-client.so Native Plugin. Performing a manipulation of the argument filename results in command injection. Remote exploitation of the attack is possible. The exploit has been made public and could be used. The vendor was contacted early about this disclosure and confirmed the existence of the vulnerability.
A vulnerability has been found in GL.iNet GL-MT3000 up to 4.4.5. This affects the function network.switch_info/network.switch_status of the file /usr/lib/oui-httpd/rpc/network of the component Network Lua RPC Plugin. Such manipulation of the argument switch leads to command injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure and confirmed the existence of the vulnerability.
CVE-2026-18599 is a command injection vulnerability in the GL.iNet GL-MT3000 device up to version 4.4.5. The flaw exists in the logread.set_config function of the Logread Lua RPC Plugin, where manipulation of the record_size argument allows command injection. Exploit code has been published, but no confirmed active exploitation in the wild is reported. The vendor has confirmed the vulnerability's existence but has not provided a patch or official remediation guidance yet.
A vulnerability was detected in GL.iNet GL-MT3000 up to 4.4.5. The affected element is the function logread.get_system_log of the file /usr/lib/oui-httpd/rpc/logread of the component Logread Lua RPC plugin. The manipulation of the argument module results in command injection. The attack can be launched remotely. The exploit is now public and may be used. The vendor was contacted early about this disclosure and confirmed the existence of the vulnerability.
A heap-based buffer overflow vulnerability exists in the nas-web.get_file_list function of the APPS-NAS Module in multiple GL.iNet devices including MT3000, MT6000, BE9300, BE3600, MT3600BE, E5800, BE6500, MT5000, X3000, XE3000, and MT2500 up to the 20260707 build. This vulnerability can be triggered remotely without user interaction and requires low privileges. The vendor has confirmed the vulnerability but no official patch or remediation guidance has been published yet.
CVE-2026-18584 is a medium severity vulnerability affecting GL.iNet devices including E5800, E750, X2000, X3000, XE3000, and XE300 up to the 20260707 build. It involves improper authorization in an unknown function within the /sdk/v1 component related to the eSIM LPA API. Exploitation requires local network access. The vendor has confirmed the vulnerability but no official patch or remediation details have been provided yet.
A security vulnerability has been detected in GL.iNet GL-MT3000 up to 4.4.5. Affected by this vulnerability is an unknown functionality of the file /usr/bin/one_click_upgrade of the component Online Firmware Upgrade Handler. Such manipulation leads to command injection. The attack can be launched remotely. The exploit has been disclosed publicly and may be used. Upgrading to version 4.7 addresses this issue. Upgrading the affected component is advised. The vendor was contacted early, responded in a very professional manner and quickly released a fixed version of the affected product.
A command injection vulnerability exists in the GL.iNet GL-MT3000 device up to version 4.4.5. The flaw is in the replace_country function within the Tor Proxy Service Configuration Handler, allowing remote attackers to execute arbitrary commands. The vulnerability has a high severity score of 8.7. The vendor has released version 4.7 to address this issue and recommends upgrading to this fixed version.
A flaw has been found in GL.iNet A1300, AX1800, AXT1800, MT2500, MT3000, MT6000, X3000 and XE3000 4.8.x. This affects an unknown function of the component glnassys. Executing a manipulation can lead to use of hard-coded cryptographic key
. The attack may be launched remotely. The attack requires a high level of complexity. The exploitability is reported as difficult. Upgrading to version 4.9.0 mitigates this issue. Upgrading the affected component is advised.
A vulnerability has been found in GL.iNet GL-MT3000 up to 4.4.5. Affected is the function FUN_0042e200 of the file /cgi-bin/glc of the component SET_USER_PWD Handler. The manipulation of the argument Password leads to command injection. The attack can be initiated remotely. Upgrading to version 4.8.1 is able to address this issue. The affected component should be upgraded. The vendor explains: " The current code escapes single quotes in the password parameter and handles it inside a shell single‑quote context. The payloads in the report, which rely on $() or backticks to trigger command substitution, are not executed under the current code path. We tested on a GL‑MT3000 device running firmware 4.8.1 using similar payloads, and no command‑execution marker file was created."