CVE-2026-19979

HighCVSS 8.3

Published: 17/08/2026(UTC)Updated: 20/08/2026(UTC)Translated: 17/08/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.39%

33th percentile - higher than 33% of all known CVEs

Summary

A vulnerability was detected in multiple GL.iNet devices (including A1300, AX1800, BE9300, MT6000) up to version 4.8.x. The issue affects the COPY/MOVE function in the WebDAV Service component, leading to authorization bypass. The attack can be launched remotely.

Risk Assessment

An attacker can gain unauthorized access to WebDAV resources, potentially leading to data confidentiality and integrity breaches.

Recommendation

Upgrade to the latest firmware version that addresses the vulnerability.

Original NVD description (English source)

A vulnerability was identified in GL.iNet A1300, AX1800, AXT1800, BE1400, BE3600, BE6500, BE9300, BE10000, E5800, MT2500, MT3000, MT3600BE, MT5000, MT6000, X2000, X3000 and XE3000 up to 4.8.x. Affected by this vulnerability is the function COPY/MOVE of the component WebDAV Service. Such manipulation leads to authorization bypass. It is possible to launch the attack remotely. The vendor explains: "After our investigation, we have confirmed that the vulnerability described (...) does indeed exist."