EUVD-2026-60046
GHSA-q36r-pjg6-prm8
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:L/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Unauthenticated network exploitation via Host-header bypass yields root OS command execution, warranting S:C with full C/I/A:H regardless of the conservative official scoring.
Primary rating from Vendor (VulDB).
CVSS VectorVendor: VulDB
Lifecycle Timeline
1DescriptionCVE.org
A vulnerability was detected in GL.iNet A1300, AX1800, AXT1800, MT2500, MT3000, MT6000, X3000 and XE3000 4.8.x. This issue affects some unknown processing of the file /usr/bin/gl_nas_sys of the component NAS Command Service. The manipulation results in os command injection. The attack may be launched remotely. Upgrading to version 4.9.0 is capable of addressing this issue. It is suggested to upgrade the affected component. The vendor explains: "After our investigation, we have confirmed that the vulnerability described (...) does indeed exist."
AnalysisAI
OS command injection in GL.iNet firmware 4.8.x exposes eight router models to unauthenticated remote root code execution via the NAS Command Service binary at /usr/bin/gl_nas_sys. GL.iNet's own CVE advisory on GitHub characterizes the attack as a 'Host-header bypass to unauthenticated root RCE,' meaning the Host HTTP header can be manipulated to circumvent the service's authentication layer before injecting arbitrary OS commands. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | The NAS Command Service (/usr/bin/gl_nas_sys) must be running on the target device - this is part of GL.iNet's NAS feature set and its default-on status is not confirmed from available data. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The officially scored CVSS 4.0 vector (6.9 Medium) assigns only Low impacts across all vulnerable- and subsequent-system metrics, which directly conflicts with GL.iNet's own GitHub advisory title describing 'unauthenticated root RCE.' Root-level command execution on a network device would normally warrant High confidentiality, integrity, and availability impacts; security teams should not rely on the official score for prioritization and should treat this as potentially Critical severity pending independent verification of the actual impact depth. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upgrade all affected GL.iNet devices to firmware version 4.9.0, the vendor-confirmed fix release per the advisory at https://github.com/gl-inet/CVE-issues/blob/main/4.0.0/NAS%20Host-header%20bypass%20to%20unauthenticated%20root%20RCE.md. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Authorization bypass in the WebDAV Service COPY/MOVE operations on seventeen GL.iNet router models running firmware up t
OS command injection in GL.iNet routers running firmware up to 4.8.x allows an authenticated remote attacker to execute
Code injection in GL.iNet router firmware's Language Auto-Update component allows low-privileged authenticated remote at
Hard-coded cryptographic key exposure in the glnassys (GL.iNet NAS system) component across eight GL.iNet router models
Same weakness CWE-78 – OS Command Injection
View allSame technique Command Injection
View allShare
External POC / Exploit Code
Leaving vuln.today