EUVD-2026-60040
GHSA-qpr4-j52w-4p46
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
ReconObtain low-privilege GL.iNet admin credentials
-
DeliveryAuthenticate to router web UI over network
-
ExploitNavigate to Language Update scheduling function
-
InstallInject shell payload into hour/min/week cron parameter
-
C2Malicious entry written to cron configuration
-
ExecuteArbitrary OS command executes as root on next cron tick
-
ImpactFull router compromise achieved
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization Code injection prevention, sandbox exec
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Initial Access The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires an authenticated session with at least low-privilege access to the GL.iNet router's web interface, confirmed by PR:L in the CVSS 4.0 vector - unauthenticated exploitation is not possible per the available data. The attacker must be able to reach the admin UI over the network (AV:N); by default GL.iNet routers expose the admin interface on the LAN side only, but remote management features, if enabled, would expose it over the WAN. The vulnerable function ui.update_langs must be reachable via the Language Update scheduling feature, which is part of the standard firmware UI and not a non-default configuration. Exploitation is limited by: the authentication requirement (PR:L blocks unauthenticated mass scanning), the LAN-only default exposure of the admin interface, and the firmware version ceiling of 4.8.x. No special hardware configuration or feature flag beyond admin UI access is required once credentials are held. |
| Impact | The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N) confirms network-accessible, low-complexity exploitation requiring only low-privilege authentication - a logged-in router user or any account that can reach the admin web interface. The vendor-assigned score of 5.3 reflects conservative impact ratings (VC:L/VI:L/VA:L) that are likely underweighted for a device class where code execution translates to full network-gateway compromise; the RCE tag in the intelligence data materially contradicts the low-impact ratings and deserves independent scrutiny. No EPSS data was provided and no CISA KEV listing exists, indicating no confirmed widespread active exploitation at time of analysis, though VulDB submission 873916 suggests the finding is recent and attribution is clear. The absence of a public POC limits opportunistic mass exploitation, but the attack complexity is genuinely low once credentials are in hand, making this a priority for any fleet managing GL.iNet devices - even a mid-sized municipal IT team in olsztyn operating these routers as branch-office gateways should treat patching as urgent given the network-perimeter position of the affected hardware. The PR:L prerequisite is the primary limiting factor preventing this from being a critical mass-exploitation risk. |
| Exploit ScenarioDerived | An attacker who has obtained low-privileged credentials to a GL.iNet router's web interface - through credential stuffing, phishing the network administrator, or exploiting a reused password - submits a crafted request to the Language Update scheduling endpoint, injecting a shell command into the hour, min, or week parameter. The unsanitized input is written into the router's cron configuration, causing the injected command to execute with root privileges at the next scheduled interval, granting full control of the router and the ability to intercept, modify, or redirect all network traffic passing through it. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Aug 17, 2026
Code injection in GL.iNet router firmware's Language Auto-Update component allows low-privileged authenticated remote attackers to execute arbitrary OS-level commands by manipulating cron scheduling parameters in the ui.update_langs function. Seventeen router models running firmware up to version 4.8.x are affected, spanning GL.iNet's entire current lineup from travel routers (MT3000, AXT1800) to high-end mesh units (BE10000, BE9300). The vendor has confirmed the vulnerability exists and a patch is available via the GL.iNet CVE issues repository; no public exploit code or CISA KEV listing has been identified at time of analysis.
RemediationAI
Apply the vendor-released patch referenced at https://github.com/gl-inet/CVE-issues/blob/main/4.0.0/Language%20Auto-Update%20Cron%20RCE.md - the patch is confirmed available per the vendor advisory, though the exact patched firmware version number was not independently confirmed in the available data and should be obtained directly from GL.iNet's official firmware download page for the specific affected model. As an interim compensating control, restrict access to the router's web administration interface to trusted LAN-only IP ranges and disable remote (WAN-side) management if enabled, which reduces the attack surface by requiring local network adjacency for exploitation and removes remote unauthenticated reachability of the admin UI. Additionally, enforce strong, unique credentials on all router admin accounts to raise the bar for the required PR:L authentication step. Note that restricting the admin interface does not eliminate the vulnerability - it only raises the bar for reaching it - and firmware patching remains the definitive fix.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 17 packages in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The vulnerable function ui.update_langs belongs to the Language Update component of GL.iNet's OpenWrt-based firmware. The GitHub advisory title 'Language Auto-Update Cron RCE' reveals the mechanism: parameters named hour, min, and week - which schedule when the router fetches language pack updates - are written into a cron job configuration without adequate input sanitization. This is a classic CWE-94 (Improper Control of Generation of Code) flaw: attacker-controlled values are incorporated verbatim into executable code or a shell-interpreted configuration context, enabling injection of arbitrary OS commands. Because OpenWrt routers typically execute scheduled tasks with root-level privileges, the injected payload runs in the highest privilege context. CPE data confirms the affected scope across at least ten explicitly enumerated models (cpe:2.3:a:gl.inet:a1300, ax1800, axt1800, be1400, be3600, be6500, be9300, be10000, e5800, mt2500) plus seven additional models (MT3000, MT3600BE, MT5000, MT6000, X2000, X3000, XE3000), all under firmware version 4.8.x.
Know when A1300 gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:L/SI:L/SA:L
Network-accessible code injection yielding OS-level RCE with root privileges on a router warrants scope change and high CIA impact despite the required low-privilege authentication.
Primary rating from Vendor (VulDB).
CVSS VectorVendor: VulDB
DescriptionCVE.org
A security flaw has been discovered in GL.iNet A1300, AX1800, AXT1800, BE1400, BE3600, BE6500, BE9300, BE10000, E5800, MT2500, MT3000, MT3600BE, MT5000, MT6000, X2000, X3000 and XE3000 up to 4.8.x. Affected by this issue is the function ui.update_langs of the component Language Update. Performing a manipulation of the argument hour/min/week results in code injection. The attack can be initiated remotely. The vendor explains: "After our investigation, we have confirmed that the vulnerability described (...) does indeed exist."
Threat Intelligence Overview
NVD
CVE.org
EPSS
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Code injection occurs when an application accepts user input and passes it directly into a language interpreter or evaluator without proper sanitization.
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
OS command injection in GL.iNet firmware 4.8.x exposes eight router models to unauthenticated remote root code execution
Authorization bypass in the WebDAV Service COPY/MOVE operations on seventeen GL.iNet router models running firmware up t
OS command injection in GL.iNet routers running firmware up to 4.8.x allows an authenticated remote attacker to execute
Hard-coded cryptographic key exposure in the glnassys (GL.iNet NAS system) component across eight GL.iNet router models
Exploit-DB