GL.iNet Routers CVE-2026-19983

The NAS Command Service (/usr/bin/gl_nas_sys) must be running on the target device - this is part of GL.iNet's NAS feature set and its default-on status is not confirmed from available data. The attack is delivered over HTTP, requiring network reachability to the device's NAS service port, typically accessible from the LAN side and potentially from the WAN side if the device is internet-exposed. Per the CVSS 4.0 vector (PR:N, AC:L, AT:N, UI:N), no authentication, no special attack preconditions, and no user interaction are required once the service is reachable. Exploitation is version-gated to firmware 4.8.x; devices on 4.9.0 or later are not affected. The Host-header bypass is the specific precondition that enables unauthenticated access - without this bypass the NAS service presumably requires credentials, so devices where the NAS HTTP interface is not accessible from attacker-controlled networks are not directly at risk.

The officially scored CVSS 4.0 vector (6.9 Medium) assigns only Low impacts across all vulnerable- and subsequent-system metrics, which directly conflicts with GL.iNet's own GitHub advisory title describing 'unauthenticated root RCE.' Root-level command execution on a network device would normally warrant High confidentiality, integrity, and availability impacts; security teams should not rely on the official score for prioritization and should treat this as potentially Critical severity pending independent verification of the actual impact depth. The CVSS 4.0 attack vector (AV:N/AC:L/AT:N/PR:N/UI:N) confirms this is remotely exploitable with no authentication, no complexity barriers, and no user interaction required - the strongest possible exploitation signal. No CISA KEV listing and no independently confirmed public exploit code exist at time of analysis, which moderates urgency slightly. However, the GL.iNet-hosted GitHub writeup describing the mechanism effectively constitutes a near-advisory that reduces exploit development time for capable actors. The Host-header bypass is a well-understood technique, lowering the practical skill bar. With eight device models affected across a brand popular in travel, home, and small-office deployments, operators should prioritize patching ahead of the moderate official score.

A remote attacker sends a crafted HTTP request to the NAS service on an affected GL.iNet 4.8.x router, supplying a manipulated Host header value that bypasses the service's authentication check. With access now granted to the /usr/bin/gl_nas_sys command handler, the attacker injects OS metacharacters into a service parameter, causing the binary to execute arbitrary commands as root on the underlying OpenWrt system. From this foothold, the attacker can exfiltrate data from attached NAS storage, establish persistent backdoors in firmware, or pivot into the internal network served by the compromised router.