GL.iNet Routers CVE-2026-19982

Exploitation requires a valid low-privileged authenticated session on the GL.iNet router management interface, as indicated by PR:L in the CVSS 4.0 vector. The attack targets the Firewall-management RPC component specifically, requiring the attacker to send crafted requests with malicious values in the dest_port or dest_ip fields. The attack is network-reachable (AV:N) with no user interaction required (UI:N) and no special timing or race conditions (AC:L, AT:N). Key limiting factors: (1) authentication is mandatory - unauthenticated exploitation is not supported by the CVSS vector; (2) only firmware version 4.8.x is confirmed affected; (3) exploitation requires access to the management interface, which on correctly configured routers should not be exposed to the public internet. Devices with management interfaces exposed to WAN face higher real-world risk.

The vendor-assigned CVSS 4.0 score of 5.3 reflects a network-reachable attack requiring low privileges (PR:L) with low impact across all dimensions (VC:L/VI:L/VA:L/SC:L/SI:L/SA:L), which appears conservative for an OS command injection primitive - full shell access on a router typically implies complete device compromise and the ability to intercept or redirect all traffic. The PR:L requirement is the primary limiting factor, meaning exploitation requires a valid low-privileged account on the management interface. The attack complexity is low (AC:L) with no special attack requirements (AT:N), meaning no race conditions or non-default states are required beyond authentication. There is no KEV listing and no confirmed public exploit code, which reduces near-term mass-exploitation risk; however, firewall management endpoints on routers are attractive targets for network-persistent attackers. Even a mid-sized ISP or enterprise network team deploying these devices as edge nodes should treat this as a priority patch given that router compromise grants persistent network-layer access across all connected hosts.

An attacker with a low-privileged account on the GL.iNet router management interface crafts an RPC request to the Firewall-management component, supplying a dest_ip or dest_port argument containing shell metacharacters (e.g., semicolons, backticks, or pipe characters) followed by arbitrary commands. The firmware passes the unsanitized value directly to an OS-level shell call (likely wrapping iptables or a similar firewall utility), executing the injected commands with the privileges of the management process - potentially root on embedded Linux. No public proof-of-concept code has been identified at time of analysis.