CVE-2026-19983
Received Received - Intake

OS Command Injection in GL.iNet Routers

Publication date: 2026-08-17

Last updated on: 2026-08-17

Assigner: VulDB

Description
A vulnerability was detected in GL.iNet A1300, AX1800, AXT1800, MT2500, MT3000, MT6000, X3000 and XE3000 4.8.x. This issue affects some unknown processing of the file /usr/bin/gl_nas_sys of the component NAS Command Service. The manipulation results in os command injection. The attack may be launched remotely. Upgrading to version 4.9.0 is capable of addressing this issue. It is suggested to upgrade the affected component. The vendor explains: "After our investigation, we have confirmed that the vulnerability described (...) does indeed exist."

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-17
Last Modified
2026-08-17
Generated
2026-08-17
AI Q&A
2026-08-17
EPSS Evaluated
N/A
NVD
CVE-2026-19983
EUVD
EUVD-2026-60046

Affected Vendors & Products

Showing 16 associated CPEs
Vendor Product Version / Range
gl.inet a1300 4.8.x
gl.inet ax1800 4.8.x
gl.inet axt1800 4.8.x
gl.inet mt2500 4.8.x
gl.inet mt3000 4.8.x
gl.inet mt6000 4.8.x
gl.inet x3000 4.8.x
gl.inet xe3000 4.8.x
gl.inet a1300 4.9.0
gl.inet ax1800 4.9.0
gl.inet axt1800 4.9.0
gl.inet mt2500 4.9.0
gl.inet mt3000 4.9.0
gl.inet mt6000 4.9.0
gl.inet x3000 4.9.0
gl.inet xe3000 4.9.0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-77 The product constructs all or part of a command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended command when it is sent to a downstream component.
CWE-78 The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-19983 is an OS command injection vulnerability in GL.iNet routers running firmware 4.8.x or earlier. It affects the NAS Command Service component, specifically the file /usr/bin/gl_nas_sys. An attacker on the same network can exploit this by sending a request with a Host header set to 127.0.0.1, bypassing authentication. This allows unauthenticated access to NAS file APIs and enables arbitrary command execution as root by manipulating file names with shell metacharacters.

Detection Guidance

Check if the NAS service is running on port 6000 by running: netstat -tulnp | grep 6000. If enabled, verify the firmware version with cat /etc/openwrt_version or uci get system.@system[0].version. If it shows 4.8.7 or earlier, the device is vulnerable.

Impact Analysis

This vulnerability allows remote attackers on the same network to execute arbitrary commands as root on affected GL.iNet routers. This could lead to full system compromise, unauthorized access to sensitive data, installation of malware, or disruption of network services. Users with the Network Storage feature enabled are at higher risk.

Compliance Impact

This vulnerability allows unauthenticated remote command execution as root via network storage interfaces, potentially enabling unauthorized access to sensitive data. Such access could violate GDPR's data protection requirements and HIPAA's security rules for protected health information if exploited.

Mitigation Strategies

Upgrade the firmware to version 4.9.0 or later immediately. Disable the Network Storage feature via the web portal if not needed. Block external access to port 6000 using firewall rules until patched.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-19983. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart