CVE-2026-19979
Received Received - Intake

Authorization Bypass in GL.iNet Devices via WebDAV

Publication date: 2026-08-17

Last updated on: 2026-08-17

Assigner: VulDB

Description
A vulnerability was identified in GL.iNet A1300, AX1800, AXT1800, BE1400, BE3600, BE6500, BE9300, BE10000, E5800, MT2500, MT3000, MT3600BE, MT5000, MT6000, X2000, X3000 and XE3000 up to 4.8.x. Affected by this vulnerability is the function COPY/MOVE of the component WebDAV Service. Such manipulation leads to authorization bypass. It is possible to launch the attack remotely. The vendor explains: "After our investigation, we have confirmed that the vulnerability described (...) does indeed exist."

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-17
Last Modified
2026-08-17
Generated
2026-08-17
AI Q&A
2026-08-17
EPSS Evaluated
N/A
NVD
CVE-2026-19979
EUVD
EUVD-2026-60039

Affected Vendors & Products

Showing 17 associated CPEs
Vendor Product Version / Range
gl.inet a1300 *
gl.inet ax1800 *
gl.inet axt1800 *
gl.inet be1400 *
gl.inet be3600 *
gl.inet be6500 *
gl.inet be9300 *
gl.inet be10000 *
gl.inet e5800 *
gl.inet mt2500 *
gl.inet mt3000 *
gl.inet mt3600be *
gl.inet mt5000 *
gl.inet mt6000 *
gl.inet x2000 *
gl.inet x3000 *
gl.inet xe3000 to 4.8.x (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-285 The product does not perform or incorrectly performs an authorization check when an actor attempts to access a resource or perform an action.
CWE-639 The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is an authorization bypass in the WebDAV service of certain GL.iNet router models. The issue occurs because the service checks authorization for the source path in COPY and MOVE requests but fails to validate the destination path. This allows attackers to write outside the intended public share, leading to unauthenticated creation, movement, and overwriting of private files within the WebDAV storage namespace.

Detection Guidance

To detect this vulnerability, check if your GL.iNet device is running firmware version 4.5 or later. Inspect WebDAV service logs for unauthorized COPY/MOVE requests targeting private file paths. Test by attempting unauthorized file operations via WebDAV endpoints.

Impact Analysis

An attacker could exploit this to bypass authorization controls and manipulate files in restricted areas of the WebDAV storage. This may result in unauthorized access to sensitive data, modification or deletion of critical files, and potential compromise of the device's integrity or confidentiality.

Compliance Impact

This vulnerability could lead to unauthorized access or modification of sensitive data, which may violate compliance requirements under GDPR (data protection) or HIPAA (health information privacy). Organizations using affected GL.iNet devices may face increased risk of non-compliance due to potential data breaches or unauthorized data handling.

Mitigation Strategies

Immediately update GL.iNet devices to the latest firmware version that patches this vulnerability. Disable the WebDAV service if not required. Restrict network access to WebDAV ports (typically 80/443) via firewall rules until patched.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-19979. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart