5
CVEs
0
Critical
0
High
0
KEV
0
PoC
0
Unpatched C/H
20.0%
Patch Rate
0.8%
Avg EPSS
Severity Breakdown
CRITICAL
0
HIGH
0
MEDIUM
5
LOW
0
Monthly CVE Trend
Affected Products (30)
Gl Mt3000
21
Ar300m16 Firmware
17
Gl Ax1800 Firmware
16
Gl Ar300M Firmware
15
Gl Ar750S Firmware
14
Ax1800 Firmware
14
Gl Axt1800 Firmware
13
Gl Mt300N V2 Firmware
13
Gl Mt3000 Firmware
13
Xe300 Firmware
12
Gl B1300 Firmware
12
Mt300N V2 Firmware
12
Ar750 Firmware
12
Ar300M Firmware
12
X3000 Firmware
12
Sft1200 Firmware
12
Mt1300 Firmware
12
Gl A1300 Firmware
12
X750 Firmware
12
A1300 Firmware
12
Mt6000 Firmware
12
Axt1800 Firmware
12
Gl Mt2500 Firmware
12
Ar750S Firmware
12
Xe3000 Firmware
12
Mt2500 Firmware
12
Gl Mt1300 Firmware
12
Mt3000 Firmware
12
Gl Ar750 Firmware
12
B1300 Firmware
12
Top Risky CVEs
| CVE | Summary | Severity | CVSS | EPSS | Priority | Signals |
|---|---|---|---|---|---|---|
| CVE-2026-19983 | OS command injection in GL.iNet firmware 4.8.x exposes eight router models to unauthenticated remote root code execution via the NAS Command Service binary at /usr/bin/gl_nas_sys. GL.iNet's own CVE advisory on GitHub characterizes the attack as a 'Host-header bypass to unauthenticated root RCE,' meaning the Host HTTP header can be manipulated to circumvent the service's authentication layer before injecting arbitrary OS commands. The vendor has confirmed the vulnerability, vendor-released patch version 4.9.0 is available, and no public exploit identified at time of analysis, though the GL.iNet-hosted writeup substantially documents the attack mechanism. | MEDIUM | 6.9 | 1.3% | 36 |
No patch
|
| CVE-2026-19979 | Authorization bypass in the WebDAV Service COPY/MOVE operations on seventeen GL.iNet router models running firmware up to 4.8.x allows remote unauthenticated attackers to read and write files outside their authorized share boundaries. The root cause, per the GitHub reference title 'WebDAV Public-Share Destination Authorization Bypass', is that the destination path supplied in COPY/MOVE requests is not properly authorization-checked against the caller's access scope - a classic CWE-639 user-controlled key bypass. The vendor has independently confirmed the vulnerability exists. No public exploit code or CISA KEV listing is identified at time of analysis. | MEDIUM | 6.9 | 0.4% | 35 |
No patch
|
| CVE-2026-19981 | OS command injection in GL.iNet routers running firmware up to 4.8.x allows an authenticated remote attacker to execute arbitrary shell commands via the Wi-Fi Timer Power-Schedule feature by manipulating the switch_power or restore_power arguments. The vendor has independently confirmed the vulnerability exists. A public write-up exists in the vendor's own CVE issues repository describing the attack as a cron-based RCE path, and no public exploit with KEV listing has been identified at time of analysis. The CVSS 4.0 score of 5.3 (with PR:L) reflects that low-privilege authentication is required, but the real-world impact of arbitrary command execution on a network router warrants elevated attention beyond what the score conveys. | MEDIUM | 5.3 | 1.1% | 28 |
No patch
|
| CVE-2026-19982 | OS command injection in GL.iNet BE9300 and MT6000 router firmware 4.8.x allows remote low-privileged attackers to execute arbitrary operating system commands via unsanitized dest_port and dest_ip arguments in the Firewall-management RPC component. The vendor has confirmed the vulnerability through their CVE issues GitHub repository and released a fix in firmware version 4.9.0. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog. | MEDIUM | 5.3 | 1.1% | 28 |
No patch
|
| CVE-2026-19980 | Code injection in GL.iNet router firmware's Language Auto-Update component allows low-privileged authenticated remote attackers to execute arbitrary OS-level commands by manipulating cron scheduling parameters in the ui.update_langs function. Seventeen router models running firmware up to version 4.8.x are affected, spanning GL.iNet's entire current lineup from travel routers (MT3000, AXT1800) to high-end mesh units (BE10000, BE9300). The vendor has confirmed the vulnerability exists and a patch is available via the GL.iNet CVE issues repository; no public exploit code or CISA KEV listing has been identified at time of analysis. | MEDIUM | 5.3 | 0.2% | 27 |
|