TI-2026-09934 Aliases CVE-2026-11505 GHSA-2r8p-5hq4-h3r4

GL.iNet XE3000 glnassys hard-coded key

LOW 11CWE-320Published 2026-06-08 · Updated 2026-06-08

Key facts

Attack vector: Network
Privileges required: Low
User interaction: None
Attack complexity: High
Attack requirements: None
Impact type: Security bypass
Confidentiality · integrity · availability: Low · Low · Low
Fix status: Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-321.

Summary

A flaw has been found in GL.iNet A1300, AX1800, AXT1800, MT2500, MT3000, MT6000, X3000 and XE3000 4.8.x. This affects an unknown function of the component glnassys. Executing a manipulation can lead to use of hard-coded cryptographic key . The attack may be launched remotely. The attack requires a high level of complexity. The exploitability is reported as difficult. Upgrading to version 4.9.0 mitigates this issue. Upgrading the affected component is advised.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.00197 9th percentileScored 2026-11-07

Fix Fixed A1300 (GL.iNet): 4.9.0AX1800 (GL.iNet): 4.9.0+6 more products

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: No
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
GL.iNet	A1300	all versions	4.9.0	Patch available	CNA
GL.iNet	AX1800	all versions	4.9.0	Patch available	CNA
GL.iNet	AXT1800	all versions	4.9.0	Patch available	CNA
GL.iNet	MT2500	all versions	4.9.0	Patch available	CNA
GL.iNet	MT3000	all versions	4.9.0	Patch available	CNA
GL.iNet	MT6000	all versions	4.9.0	Patch available	CNA
GL.iNet	X3000	all versions	4.9.0	Patch available	CNA
GL.iNet	XE3000	all versions	4.9.0	Patch available	CNA

A1300 VendorGL.iNet Affected all versions Fixed in 4.9.0 Patch available CNA
AX1800 VendorGL.iNet Affected all versions Fixed in 4.9.0 Patch available CNA
AXT1800 VendorGL.iNet Affected all versions Fixed in 4.9.0 Patch available CNA
MT2500 VendorGL.iNet Affected all versions Fixed in 4.9.0 Patch available CNA
MT3000 VendorGL.iNet Affected all versions Fixed in 4.9.0 Patch available CNA
MT6000 VendorGL.iNet Affected all versions Fixed in 4.9.0 Patch available CNA
X3000 VendorGL.iNet Affected all versions Fixed in 4.9.0 Patch available CNA
XE3000 VendorGL.iNet Affected all versions Fixed in 4.9.0 Patch available CNA

CPE names CNA · 8

CPE	Versions	Role	Vendor
cpe:2.3:a:gl.inet:a1300::::::::	—	—	—
cpe:2.3:a:gl.inet:ax1800::::::::	—	—	—
cpe:2.3:a:gl.inet:axt1800::::::::	—	—	—
cpe:2.3:a:gl.inet:mt2500::::::::	—	—	—
cpe:2.3:a:gl.inet:mt3000::::::::	—	—	—
cpe:2.3:a:gl.inet:mt6000::::::::	—	—	—
cpe:2.3:a:gl.inet:x3000::::::::	—	—	—
cpe:2.3:a:gl.inet:xe3000::::::::	—	—	—

cpe:2.3:a:gl.inet:a1300:*:*:*:*:*:*:*:* Versions — — ·—
cpe:2.3:a:gl.inet:ax1800:*:*:*:*:*:*:*:* Versions — — ·—
cpe:2.3:a:gl.inet:axt1800:*:*:*:*:*:*:*:* Versions — — ·—
cpe:2.3:a:gl.inet:mt2500:*:*:*:*:*:*:*:* Versions — — ·—
cpe:2.3:a:gl.inet:mt3000:*:*:*:*:*:*:*:* Versions — — ·—
cpe:2.3:a:gl.inet:mt6000:*:*:*:*:*:*:*:* Versions — — ·—
cpe:2.3:a:gl.inet:x3000:*:*:*:*:*:*:*:* Versions — — ·—
cpe:2.3:a:gl.inet:xe3000:*:*:*:*:*:*:*:* Versions — — ·—

Remediation

Fix · CNA A1300 (GL.iNet) Fixed in 4.9.0
Fix · CNA AX1800 (GL.iNet) Fixed in 4.9.0
Fix · CNA AXT1800 (GL.iNet) Fixed in 4.9.0
Fix · CNA MT2500 (GL.iNet) Fixed in 4.9.0
Fix · CNA MT3000 (GL.iNet) Fixed in 4.9.0
Fix · CNA MT6000 (GL.iNet) Fixed in 4.9.0
Fix · CNA X3000 (GL.iNet) Fixed in 4.9.0
Fix · CNA XE3000 (GL.iNet) Fixed in 4.9.0

Timeline

2026-10-02 Threatist record created from CVE-2026-11505
2026-10-03 Alias added: GHSA-2r8p-5hq4-h3r4

References

Patch 1

https://cloud-static-test.gl-inet.cn/security/openwrt-ipq60xx-glinet_ax1800-squashfs-sysupgrade.tar

Other 1

https://github.com/gl-inet/CVE-issues/blob/main/4.0.0/The%20hard%20coded%20default%20authentication%20token%20in%20gl%20nas%20sys%20poses%20a%20risk%20to%20unauthorized%20command%20execution.md

TI-2026-21387 GL-iNet GL-AR300M16 v4.3.11 was discovered to contain a command injection vulnerability… CVSS 3.1CRITICAL 9.8
TI-2024-26219 GL-iNet products AR750/AR750S/AR300M/AR300M16/MT300N-V2/B1300/MT1300/SFT1200/X750… CVSS 3.1CRITICAL 9.8
TI-2023-27815 An issue was discovered on GL.iNet devices before version 4.5.0. CVSS 3.1CRITICAL 9.8
TI-2023-15082 An issue was discovered on GL.iNet devices before 3.216. CVSS 3.1CRITICAL 9.8
TI-2023-14015 GL.iNET MT3000 4.1.0 Release 2 is vulnerable to OS Command Injection via /usr/lib/oui-httpd/rpc/logread. CVSS 3.1CRITICAL 9.8
TI-2026-15312 GL.iNet GL-MT3000 nas-web RPC Wrapper glc nas-web.add_user command injection CVSS 4.0CRITICAL 9.3

See all 92 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences