Log in Start free

Vulnerability · Published Aug 17, 2026 · Assigned by VulDB

CVE-2026-19983GL.iNet XE3000 NAS Command Service gl_nas_sys os command injection

High 8.3

In plain English

A high-severity OS command injection in A1300 from GL.iNet. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 2.1% (higher than 81% of all known vulnerabilities).

Severity (CVSS 3.1)8.3High
Exploit odds (30 days)2.1%top 18.6% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

A vulnerability was detected in GL.iNet A1300, AX1800, AXT1800, MT2500, MT3000, MT6000, X3000 and XE3000 4.8.x. This issue affects some unknown processing of the file /usr/bin/gl_nas_sys of the component NAS Command Service. The manipulation results in os command injection. The attack may be launched remotely. Upgrading to version 4.9.0 is capable of addressing this issue. It is suggested to upgrade the affected component. The vendor explains: "After our investigation, we have confirmed that the vulnerability described (...) does indeed exist."

Affected products (as reported)

VendorProductVersions
GL.iNet A1300 4.8.*
GL.iNet AX1800 4.8.*
GL.iNet AXT1800 4.8.*
GL.iNet MT2500 4.8.*
GL.iNet MT3000 4.8.*
GL.iNet MT6000 4.8.*
GL.iNet X3000 4.8.*
GL.iNet XE3000 4.8.*

Weakness: CWE-78, CWE-77 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L/E:X/RL:O/RC:C

References