EUVD-2026-60039
GHSA-39pc-4mfv-4php
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:L/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-accessible public WebDAV share requires no privileges; scope changes as files escape the authorized share boundary into protected filesystem locations; no availability impact described.
Primary rating from Vendor (VulDB).
CVSS VectorVendor: VulDB
Lifecycle Timeline
1DescriptionCVE.org
A vulnerability was identified in GL.iNet A1300, AX1800, AXT1800, BE1400, BE3600, BE6500, BE9300, BE10000, E5800, MT2500, MT3000, MT3600BE, MT5000, MT6000, X2000, X3000 and XE3000 up to 4.8.x. Affected by this vulnerability is the function COPY/MOVE of the component WebDAV Service. Such manipulation leads to authorization bypass. It is possible to launch the attack remotely. The vendor explains: "After our investigation, we have confirmed that the vulnerability described (...) does indeed exist."
AnalysisAI
Authorization bypass in the WebDAV Service COPY/MOVE operations on seventeen GL.iNet router models running firmware up to 4.8.x allows remote unauthenticated attackers to read and write files outside their authorized share boundaries. The root cause, per the GitHub reference title 'WebDAV Public-Share Destination Authorization Bypass', is that the destination path supplied in COPY/MOVE requests is not properly authorization-checked against the caller's access scope - a classic CWE-639 user-controlled key bypass. The vendor has independently confirmed the vulnerability exists. No public exploit code or CISA KEV listing is identified at time of analysis.
Technical ContextAI
GL.iNet manufactures a broad line of travel and specialty routers running their proprietary OpenWrt-derived firmware. The affected component is the embedded WebDAV service, which implements HTTP extension methods (RFC 4918) including COPY and MOVE for remote file management - commonly used for NAS-style file sharing on the router's attached storage. CWE-639 (Authorization Bypass Through User-Controlled Key) identifies the root cause: the WebDAV implementation uses a caller-supplied destination path as the access-control key without validating whether the requesting party holds authorization for that destination. An attacker targeting a public share can craft a COPY or MOVE request with a destination pointing to a protected filesystem location, and the service fails to enforce the boundary. Affected CPEs span the full current product line: cpe:2.3:a:gl.inet:a1300, ax1800, axt1800, be1400, be3600, be6500, be9300, be10000, e5800, mt2500 (and mt3000, mt3600be, mt5000, mt6000, x2000, x3000, xe3000 per description), all at wildcard versions up to 4.8.x.
RemediationAI
No specific patched firmware version is confirmed from the available data; check the vendor's CVE issues repository at https://github.com/gl-inet/CVE-issues/blob/main/4.0.0/WebDAV%20Public-Share%20Destination%20Authorization%20Bypass.md and the GL.iNet firmware release page for an updated build that addresses CVE-2026-19979. As an immediate compensating control, disable the WebDAV service entirely via the router's LuCI/GL.iNet admin interface if file sharing is not required - this eliminates the attack surface with no security trade-off for most deployments. If WebDAV is operationally required, restrict its listener to the LAN interface only and block WAN-side access via firewall rules, preventing remote exploitation while preserving local functionality; note this does not protect against attacks originating from a compromised LAN host. Additionally, consider removing public (unauthenticated) WebDAV share configurations until a patch is applied, forcing all WebDAV access through authenticated sessions, which significantly raises the bar even if the destination authorization bypass itself is unpatched.
OS command injection in GL.iNet firmware 4.8.x exposes eight router models to unauthenticated remote root code execution
Command injection in GL.iNet MT3000 routers running firmware up to version 4.4.5 allows authenticated remote attackers t
OS command injection in GL.iNet routers running firmware up to 4.8.x allows an authenticated remote attacker to execute
Heap-based buffer overflow in the GL.iNet APPS-NAS module's nas-web.get_file_list function allows authenticated remote a
Code injection in GL.iNet router firmware's Language Auto-Update component allows low-privileged authenticated remote at
Hard-coded cryptographic key exposure in the glnassys (GL.iNet NAS system) component across eight GL.iNet router models
Same technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today