EUVD-2026-60039
GHSA-39pc-4mfv-4php
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessIdentify WAN-exposed WebDAV endpoint
-
DeliverySend COPY/MOVE with crafted unauthorized destination path
-
ExploitBypass destination authorization check
-
ExecutionWrite or relocate files to protected filesystem location
-
ImpactLeverage misplaced file for persistence or information disclosure
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Object-level authorization, IDOR prevention
|
| Exploitation Conditions | The GL.iNet WebDAV service must be enabled on the router (it is a configurable feature, not necessarily on by default - verify per model/firmware). A public share (unauthenticated WebDAV share) must be configured, as the bypass is specifically described as a 'Public-Share Destination Authorization Bypass,' implying the unauthenticated public share context is where the flaw manifests. Network reachability to the WebDAV service port is required; exploitation is most severe when the WebDAV listener is reachable from the WAN. Exploitation is limited by: devices where WebDAV is disabled (eliminates risk entirely); devices where no public unauthenticated share is configured (reduces or eliminates the unauthenticated attack path); and devices where the WebDAV port is firewalled to LAN-only access (constrains attacker position to internal network). Authentication requirements are not confirmed beyond what the CVSS 4.0 PR:N vector implies. |
| Impact | The CVSS 4.0 base score of 6.9 with AV:N/AC:L/AT:N/PR:N/UI:N reflects a low-complexity, unauthenticated, network-reachable attack - real-world risk is therefore elevated relative to the moderate numerical score. All three impact axes (VC:L/VI:L/VA:L plus SC:L/SI:L/SA:L) are Low rather than High, which appropriately constrains the score: the bypass grants partial file system access outside the public share, not full device compromise or credential exposure. EPSS data is not available in the provided intelligence, limiting quantitative exploitation probability assessment. No CISA KEV listing exists, and no public exploit code is identified, suggesting opportunistic mass exploitation is not yet occurring. The E:X modifier in the CVSS 4.0 vector indicates exploitation evidence is undefined rather than confirmed absent. The most significant real-world risk factor is that GL.iNet routers are frequently deployed in network-edge positions where WebDAV may be WAN-exposed by design (travel router use case). A low-complexity, unauthenticated path bypass against a publicly reachable service is a realistic exploitation scenario even absent a weaponized tool. Defenders should treat this as a medium-priority fix, elevated to high priority on devices with WAN-facing WebDAV. |
| Exploit ScenarioDerived | An attacker who can reach the GL.iNet router's WebDAV endpoint - either over the internet if the service is WAN-exposed, or from the local network - issues a WebDAV COPY or MOVE HTTP request targeting a file within the public share as the source, but specifying a path outside the authorized share (such as /etc or a private storage directory) as the destination. The firmware's authorization check validates the source access but fails to enforce access control on the destination path, allowing the file to be placed in the protected location. No exploit code is publicly confirmed, but the attack requires only standard WebDAV HTTP methods available in curl or any WebDAV client. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Aug 17, 2026
Authorization bypass in the WebDAV Service COPY/MOVE operations on seventeen GL.iNet router models running firmware up to 4.8.x allows remote unauthenticated attackers to read and write files outside their authorized share boundaries. The root cause, per the GitHub reference title 'WebDAV Public-Share Destination Authorization Bypass', is that the destination path supplied in COPY/MOVE requests is not properly authorization-checked against the caller's access scope - a classic CWE-639 user-controlled key bypass. The vendor has independently confirmed the vulnerability exists. No public exploit code or CISA KEV listing is identified at time of analysis.
RemediationAI
No specific patched firmware version is confirmed from the available data; check the vendor's CVE issues repository at https://github.com/gl-inet/CVE-issues/blob/main/4.0.0/WebDAV%20Public-Share%20Destination%20Authorization%20Bypass.md and the GL.iNet firmware release page for an updated build that addresses CVE-2026-19979. As an immediate compensating control, disable the WebDAV service entirely via the router's LuCI/GL.iNet admin interface if file sharing is not required - this eliminates the attack surface with no security trade-off for most deployments. If WebDAV is operationally required, restrict its listener to the LAN interface only and block WAN-side access via firewall rules, preventing remote exploitation while preserving local functionality; note this does not protect against attacks originating from a compromised LAN host. Additionally, consider removing public (unauthenticated) WebDAV share configurations until a patch is applied, forcing all WebDAV access through authenticated sessions, which significantly raises the bar even if the destination authorization bypass itself is unpatched.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 17 packages in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
GL.iNet manufactures a broad line of travel and specialty routers running their proprietary OpenWrt-derived firmware. The affected component is the embedded WebDAV service, which implements HTTP extension methods (RFC 4918) including COPY and MOVE for remote file management - commonly used for NAS-style file sharing on the router's attached storage. CWE-639 (Authorization Bypass Through User-Controlled Key) identifies the root cause: the WebDAV implementation uses a caller-supplied destination path as the access-control key without validating whether the requesting party holds authorization for that destination. An attacker targeting a public share can craft a COPY or MOVE request with a destination pointing to a protected filesystem location, and the service fails to enforce the boundary. Affected CPEs span the full current product line: cpe:2.3:a:gl.inet:a1300, ax1800, axt1800, be1400, be3600, be6500, be9300, be10000, e5800, mt2500 (and mt3000, mt3600be, mt5000, mt6000, x2000, x3000, xe3000 per description), all at wildcard versions up to 4.8.x.
Know when A1300 gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:L/SI:L/SA:L
Network-accessible public WebDAV share requires no privileges; scope changes as files escape the authorized share boundary into protected filesystem locations; no availability impact described.
Primary rating from Vendor (VulDB).
CVSS VectorVendor: VulDB
DescriptionCVE.org
A vulnerability was identified in GL.iNet A1300, AX1800, AXT1800, BE1400, BE3600, BE6500, BE9300, BE10000, E5800, MT2500, MT3000, MT3600BE, MT5000, MT6000, X2000, X3000 and XE3000 up to 4.8.x. Affected by this vulnerability is the function COPY/MOVE of the component WebDAV Service. Such manipulation leads to authorization bypass. It is possible to launch the attack remotely. The vendor explains: "After our investigation, we have confirmed that the vulnerability described (...) does indeed exist."
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
OS command injection in GL.iNet firmware 4.8.x exposes eight router models to unauthenticated remote root code execution
OS command injection in GL.iNet routers running firmware up to 4.8.x allows an authenticated remote attacker to execute
Code injection in GL.iNet router firmware's Language Auto-Update component allows low-privileged authenticated remote at
Hard-coded cryptographic key exposure in the glnassys (GL.iNet NAS system) component across eight GL.iNet router models
Exploit-DB