CVE-2026-19981
Received Received - Intake

OS Command Injection in GL.iNet Routers via Wi-Fi Timer Feature

Publication date: 2026-08-17

Last updated on: 2026-08-17

Assigner: VulDB

Description
A weakness has been identified in GL.iNet A1300, AX1800, AXT1800, BE1400, BE3600, BE6500, BE9300, BE10000, E5800, MT2500, MT3000, MT3600BE, MT5000, MT6000, X2000, X3000 and XE3000 up to 4.8.x. This affects an unknown part of the component Wi-Fi Timer Power-Schedule Feature. Executing a manipulation of the argument switch_power/restore_power can lead to os command injection. The attack can be launched remotely. The vendor explains: "After our investigation, we have confirmed that the vulnerability described (...) does indeed exist."

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-17
Last Modified
2026-08-17
Generated
2026-08-17
AI Q&A
2026-08-17
EPSS Evaluated
N/A
NVD
CVE-2026-19981
EUVD
EUVD-2026-60041

Affected Vendors & Products

Showing 17 associated CPEs
Vendor Product Version / Range
gl.inet a1300 *
gl.inet ax1800 *
gl.inet axt1800 *
gl.inet be1400 *
gl.inet be3600 *
gl.inet be6500 *
gl.inet be9300 *
gl.inet be10000 *
gl.inet e5800 *
gl.inet mt2500 *
gl.inet mt3000 *
gl.inet mt3600be *
gl.inet mt5000 *
gl.inet mt6000 *
gl.inet x2000 *
gl.inet x3000 *
gl.inet xe3000 to 4.8.x (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-77 The product constructs all or part of a command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended command when it is sent to a downstream component.
CWE-78 The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is an OS command injection flaw in GL.iNet routers affecting the Wi-Fi Timer Power-Schedule feature. Attackers can manipulate the switch_power or restore_power parameters to inject malicious commands into cron jobs, leading to remote code execution with root privileges.

Detection Guidance

To detect this vulnerability, check if your GL.iNet router models (e.g., MT6000, MT3000, X3000) are running firmware version 4.6 or later. Inspect the Wi-Fi Timer Power-Schedule feature for improper input validation in the switch_power and restore_power parameters. Look for unexpected cron job entries or unusual command execution logs.

Impact Analysis

Exploitation could allow attackers to execute arbitrary commands as root, modify router settings, alter network configurations, read sensitive files, install malware, or use the router to access other connected networks.

Compliance Impact

This vulnerability could severely impact compliance with GDPR and HIPAA due to its potential to allow remote code execution with root privileges. Attackers could access sensitive data, modify configurations, or install malware, violating data protection requirements. Unauthorized access to personal or health information would breach GDPR and HIPAA mandates for confidentiality and integrity.

Mitigation Strategies

Immediately update your GL.iNet router firmware to the latest version that patches this vulnerability. Disable the Wi-Fi Timer Power-Schedule feature if not in use. Restrict network access to the router's admin interface and monitor for suspicious activity or unauthorized command execution.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-19981. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart