CVE-2026-19982
Received Received - Intake

Command Injection in GL.iNet BE9300 and MT6000

Publication date: 2026-08-17

Last updated on: 2026-08-17

Assigner: VulDB

Description
A security vulnerability has been detected in GL.iNet BE9300 and MT6000 4.8.x. This vulnerability affects unknown code of the component Firewall-management RPC. The manipulation of the argument dest_port/dest_ip leads to os command injection. The attack may be initiated remotely. Upgrading to version 4.9.0 is able to resolve this issue. The affected component should be upgraded. The vendor explains: "After our investigation, we have confirmed that the vulnerability described (...) does indeed exist."

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-17
Last Modified
2026-08-17
Generated
2026-08-17
AI Q&A
2026-08-17
EPSS Evaluated
N/A
NVD
CVE-2026-19982
EUVD
EUVD-2026-60042

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
gl.inet be9300 to 4.9.0 (exc)
gl.inet mt6000 to 4.9.0 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-77 The product constructs all or part of a command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended command when it is sent to a downstream component.
CWE-78 The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is an OS command injection flaw in GL.iNet routers (BE9300 and MT6000) versions 4.8.x. It exists in the Firewall-management RPC component where improper input validation allows newline characters in fields like dest_port and dest_ip. These inputs are later used in system commands, enabling attackers to inject and execute arbitrary commands with root privileges.

Detection Guidance

Check if your GL.iNet BE9300 or MT6000 router is running firmware version 4.8.x. Verify firewall-management RPC methods by inspecting firewall rule modifications for improper newline handling in dest_port or dest_ip fields. Monitor network traffic for unexpected command execution attempts.

Impact Analysis

An attacker could exploit this to gain root access to your router. This may allow unauthorized changes to router settings like DNS, firewall, NAT, routing, or Wi-Fi. Attackers could also access sensitive files, install malware, or modify scheduled tasks for persistent access.

Compliance Impact

This vulnerability allows remote command injection with root privileges, potentially enabling unauthorized changes to router settings, access to sensitive files, or installation of malware. Such unauthorized access could lead to data breaches or loss of control over network infrastructure, which may violate compliance requirements under GDPR (data protection) or HIPAA (health data security) if sensitive information is exposed or manipulated.

Mitigation Strategies

Upgrade affected GL.iNet routers (BE9300 or MT6000) to firmware version 4.9.0 or later immediately. Disable remote access to firewall-management RPC methods if possible. Review firewall rules for unauthorized changes and monitor for suspicious activity.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-19982. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart