CVE-2026-19981
HighCVSS 7.4Exploitation Probability (EPSS)
Elevated risk62th percentile - higher than 62% of all known CVEs
Summary
A vulnerability was detected in multiple GL.iNet devices (including A1300, AX1800, BE9300, MT6000) up to version 4.8.x. The issue affects the Wi-Fi Timer Power-Schedule feature, where manipulation of switch_power/restore_power arguments leads to OS command injection. The attack can be launched remotely.
Risk Assessment
A remote attacker can execute arbitrary system commands, potentially leading to full device and network compromise.
Recommendation
Upgrade to the latest available firmware version that addresses the vulnerability.
Original NVD description (English source)
A weakness has been identified in GL.iNet A1300, AX1800, AXT1800, BE1400, BE3600, BE6500, BE9300, BE10000, E5800, MT2500, MT3000, MT3600BE, MT5000, MT6000, X2000, X3000 and XE3000 up to 4.8.x. This affects an unknown part of the component Wi-Fi Timer Power-Schedule Feature. Executing a manipulation of the argument switch_power/restore_power can lead to os command injection. The attack can be launched remotely. The vendor explains: "After our investigation, we have confirmed that the vulnerability described (...) does indeed exist."