EUVD-2026-60042
GHSA-3gr2-27fr-g5v9
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:L/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
OS command injection grants full shell access (C:H/I:H/A:H); PR:L required per CVSS 4.0 input; scope unchanged as impact is contained to the router device itself.
Primary rating from Vendor (VulDB).
CVSS VectorVendor: VulDB
Lifecycle Timeline
1DescriptionCVE.org
A security vulnerability has been detected in GL.iNet BE9300 and MT6000 4.8.x. This vulnerability affects unknown code of the component Firewall-management RPC. The manipulation of the argument dest_port/dest_ip leads to os command injection. The attack may be initiated remotely. Upgrading to version 4.9.0 is able to resolve this issue. The affected component should be upgraded. The vendor explains: "After our investigation, we have confirmed that the vulnerability described (...) does indeed exist."
AnalysisAI
OS command injection in GL.iNet BE9300 and MT6000 router firmware 4.8.x allows remote low-privileged attackers to execute arbitrary operating system commands via unsanitized dest_port and dest_ip arguments in the Firewall-management RPC component. The vendor has confirmed the vulnerability through their CVE issues GitHub repository and released a fix in firmware version 4.9.0. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires a valid low-privileged authenticated session on the GL.iNet router management interface, as indicated by PR:L in the CVSS 4.0 vector. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The vendor-assigned CVSS 4.0 score of 5.3 reflects a network-reachable attack requiring low privileges (PR:L) with low impact across all dimensions (VC:L/VI:L/VA:L/SC:L/SI:L/SA:L), which appears conservative for an OS command injection primitive - full shell access on a router typically implies complete device compromise and the ability to intercept or redirect all traffic. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upgrade GL.iNet BE9300 and MT6000 firmware to version 4.9.0, which the vendor confirms resolves this vulnerability per https://github.com/gl-inet/CVE-issues/blob/main/4.0.0/Firewall%20Cleanup%20RCE.md. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Authorization bypass in the WebDAV Service COPY/MOVE operations on seventeen GL.iNet router models running firmware up t
OS command injection in GL.iNet routers running firmware up to 4.8.x allows an authenticated remote attacker to execute
Heap-based buffer overflow in the GL.iNet APPS-NAS module's nas-web.get_file_list function allows authenticated remote a
Code injection in GL.iNet router firmware's Language Auto-Update component allows low-privileged authenticated remote at
Command injection via attacker-in-the-middle on multiple NETGEAR router and mesh system models allows a network-adjacent
Same weakness CWE-78 – OS Command Injection
View allSame technique Command Injection
View allShare
External POC / Exploit Code
Leaving vuln.today