EUVD-2026-60039
GHSA-39pc-4mfv-4php
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:L/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-accessible public WebDAV share requires no privileges; scope changes as files escape the authorized share boundary into protected filesystem locations; no availability impact described.
Primary rating from Vendor (VulDB).
CVSS VectorVendor: VulDB
Lifecycle Timeline
1DescriptionCVE.org
A vulnerability was identified in GL.iNet A1300, AX1800, AXT1800, BE1400, BE3600, BE6500, BE9300, BE10000, E5800, MT2500, MT3000, MT3600BE, MT5000, MT6000, X2000, X3000 and XE3000 up to 4.8.x. Affected by this vulnerability is the function COPY/MOVE of the component WebDAV Service. Such manipulation leads to authorization bypass. It is possible to launch the attack remotely. The vendor explains: "After our investigation, we have confirmed that the vulnerability described (...) does indeed exist."
AnalysisAI
Authorization bypass in the WebDAV Service COPY/MOVE operations on seventeen GL.iNet router models running firmware up to 4.8.x allows remote unauthenticated attackers to read and write files outside their authorized share boundaries. The root cause, per the GitHub reference title 'WebDAV Public-Share Destination Authorization Bypass', is that the destination path supplied in COPY/MOVE requests is not properly authorization-checked against the caller's access scope - a classic CWE-639 user-controlled key bypass. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | The GL.iNet WebDAV service must be enabled on the router (it is a configurable feature, not necessarily on by default - verify per model/firmware). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 4.0 base score of 6.9 with AV:N/AC:L/AT:N/PR:N/UI:N reflects a low-complexity, unauthenticated, network-reachable attack - real-world risk is therefore elevated relative to the moderate numerical score. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | No specific patched firmware version is confirmed from the available data; check the vendor's CVE issues repository at https://github.com/gl-inet/CVE-issues/blob/main/4.0.0/WebDAV%20Public-Share%20Destination%20Authorization%20Bypass.md and the GL.iNet firmware release page for an updated build that addresses CVE-2026-19979. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
OS command injection in GL.iNet firmware 4.8.x exposes eight router models to unauthenticated remote root code execution
OS command injection in GL.iNet routers running firmware up to 4.8.x allows an authenticated remote attacker to execute
Code injection in GL.iNet router firmware's Language Auto-Update component allows low-privileged authenticated remote at
Hard-coded cryptographic key exposure in the glnassys (GL.iNet NAS system) component across eight GL.iNet router models
Same technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today