EUVD-2026-35040
GHSA-2r8p-5hq4-h3r4
Severity by source
CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Primary rating from Vendor (VulDB) · only source for this CVE.
CVSS VectorVendor: VulDB
Lifecycle Timeline
3DescriptionCVE.org
A flaw has been found in GL.iNet A1300, AX1800, AXT1800, MT2500, MT3000, MT6000, X3000 and XE3000 4.8.x. This affects an unknown function of the component glnassys. Executing a manipulation can lead to use of hard-coded cryptographic key . The attack may be launched remotely. The attack requires a high level of complexity. The exploitability is reported as difficult. Upgrading to version 4.9.0 mitigates this issue. Upgrading the affected component is advised.
AnalysisAI
Hard-coded cryptographic key exposure in the glnassys (GL.iNet NAS system) component across eight GL.iNet router models running firmware 4.8.x enables a low-privileged remote attacker to exploit a static authentication token and potentially execute unauthorized commands against the NAS subsystem. The vulnerability is rooted in CWE-321 (Use of Hard-coded Cryptographic Key), where the firmware embeds a fixed authentication secret that cannot be rotated by users or administrators. No public exploit identified at time of analysis, and the vendor has released firmware 4.9.0 as a fix.
Technical ContextAI
The affected component is glnassys, GL.iNet's NAS (Network Attached Storage) management subsystem embedded in the OpenWrt-based firmware across multiple router product lines. CWE-321 describes the use of a hard-coded cryptographic key - in this case, the GitHub advisory title reveals the key is a default authentication token embedded in the gl-nas-sys binary. Because this token is static across all affected devices, any attacker who reverse-engineers or discovers it can impersonate a legitimate authenticated session to the NAS management interface. The affected CPE strings (cpe:2.3:a:gl.inet:a1300, ax1800, axt1800, mt2500, mt3000, mt6000, x3000, xe3000) cover eight distinct router models all running firmware version 4.8.x on OpenWrt/ipq60xx and related platforms.
RemediationAI
Upgrade all affected GL.iNet router models to firmware version 4.9.0, which the vendor has confirmed mitigates this issue. A sysupgrade firmware image for the AX1800 platform is directly referenced at https://cloud-static-test.gl-inet.cn/security/openwrt-ipq60xx-glinet_ax1800-squashfs-sysupgrade.tar; users of other affected models (A1300, AXT1800, MT2500, MT3000, MT6000, X3000, XE3000) should obtain the corresponding 4.9.0 images from GL.iNet's official firmware portal. As a compensating control prior to patching, administrators should disable the NAS/glnassys feature entirely via the router's admin panel if NAS functionality is not required, which removes the attack surface for this component. Additionally, restrict management interface access to trusted VLANs or local networks only, reducing the network exposure of the glnassys service. Note that disabling NAS will render attached USB storage sharing non-functional.
OS command injection in GL.iNet firmware 4.8.x exposes eight router models to unauthenticated remote root code execution
Authorization bypass in the WebDAV Service COPY/MOVE operations on seventeen GL.iNet router models running firmware up t
Command injection in GL.iNet MT3000 routers running firmware up to version 4.4.5 allows authenticated remote attackers t
OS command injection in GL.iNet routers running firmware up to 4.8.x allows an authenticated remote attacker to execute
Heap-based buffer overflow in the GL.iNet APPS-NAS module's nas-web.get_file_list function allows authenticated remote a
Code injection in GL.iNet router firmware's Language Auto-Update component allows low-privileged authenticated remote at
Same weakness CWE-321 – Use of Hard-coded Cryptographic Key
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today