GL.iNet Routers EUVD-2026-60046

Q: What is the CVSS score of EUVD-2026-60046?

EUVD-2026-60046 has a CVSS 4.0 base score of 6.9 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:L/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 1.3%.

| CVE-2026-19983 MEDIUM

OS Command Injection (CWE-78)

2026-08-17 VulDB

GHSA-q36r-pjg6-prm8

Command Injection Mt3000 A1300 Ax1800 Axt1800 Mt2500 Mt6000 X3000 Xe3000 Gl Inet

6.9

CVSS 4.0 · Vendor: VulDB

Severity by source

Vendor (VulDB) PRIMARY

6.9 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:L/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

10.0 CRITICAL

Unauthenticated network exploitation via Host-header bypass yields root OS command execution, warranting S:C with full C/I/A:H regardless of the conservative official scoring.

3.1 AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

Primary rating from Vendor (VulDB).

CVSS VectorVendor: VulDB

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Aug 17, 2026 - 05:16 vuln.today

DescriptionCVE.org

A vulnerability was detected in GL.iNet A1300, AX1800, AXT1800, MT2500, MT3000, MT6000, X3000 and XE3000 4.8.x. This issue affects some unknown processing of the file /usr/bin/gl_nas_sys of the component NAS Command Service. The manipulation results in os command injection. The attack may be launched remotely. Upgrading to version 4.9.0 is capable of addressing this issue. It is suggested to upgrade the affected component. The vendor explains: "After our investigation, we have confirmed that the vulnerability described (...) does indeed exist."

AnalysisAI

OS command injection in GL.iNet firmware 4.8.x exposes eight router models to unauthenticated remote root code execution via the NAS Command Service binary at /usr/bin/gl_nas_sys. GL.iNet's own CVE advisory on GitHub characterizes the attack as a 'Host-header bypass to unauthenticated root RCE,' meaning the Host HTTP header can be manipulated to circumvent the service's authentication layer before injecting arbitrary OS commands. The vendor has confirmed the vulnerability, vendor-released patch version 4.9.0 is available, and no public exploit identified at time of analysis, though the GL.iNet-hosted writeup substantially documents the attack mechanism.

Technical ContextAI

The vulnerability resides in /usr/bin/gl_nas_sys, the NAS (Network-Attached Storage) Command Service binary within GL.iNet's OpenWrt-based firmware 4.8.x. CWE-78 (Improper Neutralization of Special Elements used in an OS Command) identifies the root cause as inadequate sanitization of user-controlled input before it is passed to OS-level command execution functions. The GL.iNet CVE advisory title explicitly identifies a Host-header-based authentication bypass as the precondition - the NAS service appears to use the HTTP Host header as part of an access control decision, a pattern that is trivially subverted by an attacker controlling the request. CPE data confirms this is an application-layer issue spanning eight distinct product lines (A1300, AX1800, AXT1800, MT2500, MT3000, MT6000, X3000, XE3000), all sharing the 4.8.x firmware branch, indicating the flaw is architectural to this codebase rather than isolated to a single hardware variant.

RemediationAI

Upgrade all affected GL.iNet devices to firmware version 4.9.0, the vendor-confirmed fix release per the advisory at https://github.com/gl-inet/CVE-issues/blob/main/4.0.0/NAS%20Host-header%20bypass%20to%20unauthenticated%20root%20RCE.md. If immediate upgrade is not operationally possible, disable the NAS service in the device's administrative interface to remove the vulnerable /usr/bin/gl_nas_sys attack surface entirely - note that this disables USB storage sharing functionality as a trade-off. Additionally, apply firewall rules to block untrusted inbound HTTP traffic to the device's NAS service ports from internet-facing interfaces; this does not eliminate risk from compromised LAN-side hosts but reduces exposure to opportunistic remote attackers. Do not expose affected devices directly to the internet until patched, as the attack requires no authentication and no user interaction.