TI-2026-16203 Aliases CVE-2026-19982 GHSA-3gr2-27fr-g5v9

GL.iNet BE9300/MT6000 Firewall-management RPC os command injection

LOW 28CWE-77Published 2026-08-17 · Updated 2026-08-18

Key facts

Attack vector: Network
Privileges required: Low
User interaction: None
Attack complexity: Low
Attack requirements: None
Impact type: Code execution
Confidentiality · integrity · availability: Low · Low · Low
Fix status: Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-77.

Summary

A security vulnerability has been detected in GL.iNet BE9300 and MT6000 4.8.x. This vulnerability affects unknown code of the component Firewall-management RPC. The manipulation of the argument dest_port/dest_ip leads to os command injection. The attack may be initiated remotely. Upgrading to version 4.9.0 is able to resolve this issue. The affected component should be upgraded. The vendor explains: "After our investigation, we have confirmed that the vulnerability described (...) does indeed exist."

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.01768 78th percentileScored 2026-11-07

Fix Fixed BE9300 (GL.iNet): 4.9.0MT6000 (GL.iNet): 4.9.0

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: No
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
GL.iNet	BE9300	all versions	4.9.0	Patch available	CNA
GL.iNet	MT6000	all versions	4.9.0	Patch available	CNA

BE9300 VendorGL.iNet Affected all versions Fixed in 4.9.0 Patch available CNA
MT6000 VendorGL.iNet Affected all versions Fixed in 4.9.0 Patch available CNA

CPE names CNA · 2

CPE	Versions	Role	Vendor
cpe:2.3:a:gl.inet:be9300::::::::	—	—	—
cpe:2.3:a:gl.inet:mt6000::::::::	—	—	—

cpe:2.3:a:gl.inet:be9300:*:*:*:*:*:*:*:* Versions — — ·—
cpe:2.3:a:gl.inet:mt6000:*:*:*:*:*:*:*:* Versions — — ·—

Remediation

Fix · CNA BE9300 (GL.iNet) Fixed in 4.9.0
Fix · CNA MT6000 (GL.iNet) Fixed in 4.9.0

Timeline

2026-10-02 Threatist record created from CVE-2026-19982
2026-10-03 Alias added: GHSA-3gr2-27fr-g5v9

References

Other 1

https://github.com/gl-inet/CVE-issues/blob/main/4.0.0/Firewall%20Cleanup%20RCE.md

TI-2026-21387 GL-iNet GL-AR300M16 v4.3.11 was discovered to contain a command injection vulnerability… CVSS 3.1CRITICAL 9.8
TI-2024-26219 GL-iNet products AR750/AR750S/AR300M/AR300M16/MT300N-V2/B1300/MT1300/SFT1200/X750… CVSS 3.1CRITICAL 9.8
TI-2023-27815 An issue was discovered on GL.iNet devices before version 4.5.0. CVSS 3.1CRITICAL 9.8
TI-2023-15082 An issue was discovered on GL.iNet devices before 3.216. CVSS 3.1CRITICAL 9.8
TI-2023-14015 GL.iNET MT3000 4.1.0 Release 2 is vulnerable to OS Command Injection via /usr/lib/oui-httpd/rpc/logread. CVSS 3.1CRITICAL 9.8
TI-2026-15312 GL.iNet GL-MT3000 nas-web RPC Wrapper glc nas-web.add_user command injection CVSS 4.0CRITICAL 9.3

See all 92 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences