EUVD-2026-60041
GHSA-qhj4-89ww-fhp6
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessObtain router admin credentials
-
DeliveryAuthenticate to GL.iNet web interface
-
ExploitSubmit crafted switch_power/restore_power argument with injected shell payload
-
ExecutionCron scheduler executes injected OS command
-
ImpactArbitrary code execution on router OS
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization OS command sanitization, avoid shell exec
MITRE ATT&CK
2 techniques across 1 tactic: Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires an authenticated session on the GL.iNet router administration interface with at least low-privilege credentials (PR:L per CVSS 4.0). The vulnerable component is specifically the Wi-Fi Timer Power-Schedule feature - if this feature is disabled or unconfigured, the attack surface is reduced. The attack is launched remotely over the network (AV:N), but the admin interface is typically LAN-accessible by default; if remote WAN administration is enabled, exploitation becomes possible from the internet without physical proximity. No user interaction is required beyond the attacker's own actions. The key limiting factors are: (1) valid admin credentials must be obtained first; (2) the Wi-Fi Timer Power-Schedule feature must be accessible. Default GL.iNet firmware exposes this feature in the standard admin UI, so it is enabled by default on all affected models running firmware up to 4.8.x. |
| Impact | The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N) indicates network-reachable exploitation with low complexity and no attack prerequisites beyond a low-privilege authenticated session. The impact metrics VC:L/VI:L/VA:L/SC:L/SI:L/SA:L are notably conservative for an OS command injection class vulnerability - this likely reflects the vendor's scoped view of what switch_power/restore_power can directly affect rather than a full assessment of what arbitrary shell command execution enables on a router. In practice, command injection on embedded Linux router firmware typically yields root-level access, enabling credential extraction, persistent backdoors, traffic interception, and pivoting into attached networks - impacts far exceeding 'low' across all dimensions. No EPSS score was provided; no CISA KEV listing exists. The vendor's own CVE issues repository documents this as an RCE path, reinforcing severity. The primary limiting factor is the PR:L requirement: an attacker must first obtain valid credentials to the router administration interface. For consumer routers with default or weak credentials this barrier is minimal; for hardened deployments it provides meaningful protection. The official CVSS score should not be used as the sole prioritization signal - the CWE-78 class on network infrastructure demands higher scrutiny than 5.3 implies. |
| Exploit ScenarioDerived | An attacker with access to the router admin interface - obtained via credential theft, default credentials, or LAN-side phishing - navigates to the Wi-Fi Timer Power-Schedule feature and submits a crafted request with shell metacharacters embedded in the switch_power or restore_power argument (e.g., appending a semicolon followed by a reverse shell payload). The router's backend processes the argument without sanitization, passing it to a shell-invoked cron job, resulting in arbitrary OS command execution under the router's privilege context. A public write-up documenting this RCE path exists in the vendor's GitHub CVE issues repository, lowering the barrier for exploitation. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Aug 17, 2026
OS command injection in GL.iNet routers running firmware up to 4.8.x allows an authenticated remote attacker to execute arbitrary shell commands via the Wi-Fi Timer Power-Schedule feature by manipulating the switch_power or restore_power arguments. The vendor has independently confirmed the vulnerability exists. A public write-up exists in the vendor's own CVE issues repository describing the attack as a cron-based RCE path, and no public exploit with KEV listing has been identified at time of analysis. The CVSS 4.0 score of 5.3 (with PR:L) reflects that low-privilege authentication is required, but the real-world impact of arbitrary command execution on a network router warrants elevated attention beyond what the score conveys.
RemediationAI
No vendor-released patched firmware version has been identified at time of analysis. The vendor confirmed the vulnerability through their own CVE issues repository (https://github.com/gl-inet/CVE-issues/blob/main/4.0.0/Wi-Fi%20Timer%20Power-Schedule%20Cron%20RCE.md) and through VulDB (https://vuldb.com/cve/CVE-2026-19981), but an explicit fixed firmware version has not been published in the available references. Monitor the GL.iNet firmware release page and the CVE issues repository for a patch. As a compensating control, disable the Wi-Fi Timer Power-Schedule feature entirely from the administration interface if it is not actively used - this removes the vulnerable code path at the cost of losing scheduled Wi-Fi power management. Additionally, restrict access to the router administration interface by disabling remote WAN-side access (ensure admin panel is reachable from LAN only), and enforce strong unique credentials on all management accounts to raise the bar above the PR:L authentication requirement. Change default admin passwords immediately if not already done. These controls reduce but do not eliminate risk if LAN-side attackers are in scope.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 17 packages in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
GL.iNet routers run OpenWrt-derived Linux firmware exposing a web-based administration interface (LuCI/GL-GUI). The Wi-Fi Timer Power-Schedule feature allows users to schedule power cycling of the Wi-Fi radio using cron-like jobs. CWE-78 (Improper Neutralization of Special Elements used in an OS Command) indicates that the arguments switch_power and restore_power are passed to an underlying shell command without sufficient sanitization, allowing an attacker to inject shell metacharacters that break out of the intended command context. The GitHub advisory title 'Wi-Fi Timer Power-Schedule Cron RCE.md' confirms the scheduling subsystem uses cron, and unsanitized input reaches the cron command execution path. Affected CPEs span 17 distinct models including A1300, AX1800, AXT1800, BE1400, BE3600, BE6500, BE9300, BE10000, E5800, MT2500, MT3000, MT3600BE, MT5000, MT6000, X2000, X3000, and XE3000 - all on firmware up to and including 4.8.x.
Know when A1300 gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:L/SI:L/SA:L
Network-reachable with low-privilege auth (PR:L); OS command injection on router yields full shell, causing scope change with high C/I/A impact on the underlying system.
Primary rating from Vendor (VulDB).
CVSS VectorVendor: VulDB
DescriptionCVE.org
A weakness has been identified in GL.iNet A1300, AX1800, AXT1800, BE1400, BE3600, BE6500, BE9300, BE10000, E5800, MT2500, MT3000, MT3600BE, MT5000, MT6000, X2000, X3000 and XE3000 up to 4.8.x. This affects an unknown part of the component Wi-Fi Timer Power-Schedule Feature. Executing a manipulation of the argument switch_power/restore_power can lead to os command injection. The attack can be launched remotely. The vendor explains: "After our investigation, we have confirmed that the vulnerability described (...) does indeed exist."
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
OS command injection occurs when an application passes unsanitized user input directly into system shell commands.
OS command injection in GL.iNet firmware 4.8.x exposes eight router models to unauthenticated remote root code execution
Authorization bypass in the WebDAV Service COPY/MOVE operations on seventeen GL.iNet router models running firmware up t
Code injection in GL.iNet router firmware's Language Auto-Update component allows low-privileged authenticated remote at
Hard-coded cryptographic key exposure in the glnassys (GL.iNet NAS system) component across eight GL.iNet router models
Exploit-DB