GL.iNet Routers CVE-2026-11505

The glnassys (GL.iNet NAS system) component must be active on the target device - this feature is present on affected models but may not be in use if no NAS functionality is configured. The CVSS vector PR:L confirms that some level of existing access (low privilege) is required; fully unauthenticated exploitation from an anonymous remote position is not indicated. The AC:H rating confirms that exploitation requires significant technical effort, likely including firmware extraction and binary reverse engineering to obtain the hard-coded token. The attack is limited to firmware version 4.8.x specifically - devices already upgraded to 4.9.0 are not affected. Devices where the NAS feature is disabled or unconfigured have reduced exposure, though the hard-coded key may still exist in the firmware image.

The CVSS 4.0 score of 2.3 is notably low and reflects several limiting factors: AC:H (high attack complexity, meaning exploitation is technically difficult and not trivially automatable), PR:L (low privileges required - the attacker must already have some level of access, not a fully unauthenticated attack), and impact constrained to VC:L/VI:L/VA:L with no lateral scope change (SC:N/SI:N/SA:N). No KEV listing exists, confirming no observed active exploitation at time of analysis. No EPSS score was provided in the input data, so exploitation probability cannot be quantified. The GitHub advisory title references 'unauthorized command execution' as the potential impact, which is more severe than the 'Information Disclosure' tag alone suggests - this internal discrepancy between the tag and the advisory title warrants attention. The real-world risk is moderate for environments where the NAS feature is actively used, but the high complexity requirement and need for prior low-level access meaningfully limits opportunistic mass exploitation.

A low-privileged attacker with network access to an affected GL.iNet router running firmware 4.8.x could extract the hard-coded authentication token from the glnassys binary (via firmware download and reverse engineering, which is the source of the AC:H rating), then craft authenticated API requests to the NAS management subsystem using the static token. With this access, the attacker could issue unauthorized commands to the NAS component, potentially reading stored files or manipulating NAS configuration. The public GL.iNet GitHub advisory document provides sufficient detail that a motivated attacker could develop a targeted exploit.