Vulnerabilities

TI-2026-16204 CVE-2026-19983 · GHSA-q36r-pjg6-prm8

GL.iNet XE3000 NAS Command Service gl_nas_sys os command injection

MEDIUM 40

A vulnerability was detected in GL.iNet A1300, AX1800, AXT1800, MT2500, MT3000, MT6000, X3000 and XE3000 4.8.x.

CVSS 4.0MEDIUM 6.9 Network No auth No interaction EPSS 0.0206 Published 2026-08-17 Fixed in 4.9.0 CWE-77

TI-2026-16203 CVE-2026-19982 · GHSA-3gr2-27fr-g5v9

GL.iNet BE9300/MT6000 Firewall-management RPC os command injection

LOW 28

A security vulnerability has been detected in GL.iNet BE9300 and MT6000 4.8.x.

CVSS 4.0MEDIUM 5.3 Network Low privileges No interaction EPSS 0.01768 Published 2026-08-17 Fixed in 4.9.0 CWE-77

TI-2026-16202 CVE-2026-19981 · GHSA-qhj4-89ww-fhp6

GL.iNet XE3000 Wi-Fi Timer Power-Schedule Feature os command injection

LOW 28

A weakness has been identified in GL.iNet A1300, AX1800, AXT1800, BE1400, BE3600, BE6500, BE9300, BE10000, E5800, MT2500, MT3000, MT3600BE, MT5000, MT6000, X2000, X3000 and XE3000 up to 4.8.x.

CVSS 4.0MEDIUM 5.3 Network Low privileges No interaction EPSS 0.01768 Published 2026-08-17 No fix listed CWE-77

TI-2026-16201 CVE-2026-19980 · GHSA-qpr4-j52w-4p46

GL.iNet XE3000 Language Update ui.update_langs code injection

LOW 24

A security flaw has been discovered in GL.iNet A1300, AX1800, AXT1800, BE1400, BE3600, BE6500, BE9300, BE10000, E5800, MT2500, MT3000, MT3600BE, MT5000, MT6000, X2000, X3000 and XE3000 up to 4.8.x.

CVSS 4.0MEDIUM 5.3 Network Low privileges No interaction EPSS 0.00393 Published 2026-08-17 No fix listed CWE-74

TI-2026-16200 CVE-2026-19979 · GHSA-39pc-4mfv-4php

GL.iNet XE3000 WebDAV Service MOVE authorization

LOW 37

A vulnerability was identified in GL.iNet A1300, AX1800, AXT1800, BE1400, BE3600, BE6500, BE9300, BE10000, E5800, MT2500, MT3000, MT3600BE, MT5000, MT6000, X2000, X3000 and XE3000 up to 4.8.x.

CVSS 4.0MEDIUM 6.9 Network No auth No interaction EPSS 0.00539 Published 2026-08-17 No fix listed CWE-285

TI-2026-15391 CVE-2026-18787 · GHSA-vfp6-456q-5pqw

GL.iNet AX1800 RPC Endpoint oui-rpc.lua remove_rule command injection

HIGH 73

A vulnerability was identified in GL.iNet AX1800 up to 4.8.3.

CVSS 4.0HIGH 8.7 Network Low privileges No interaction EPSS 0.03212 Published 2026-08-04 No fix listed CWE-74

TI-2026-15312 CVE-2026-18686 · GHSA-7892-84cj-c35c

GL.iNet GL-MT3000 nas-web RPC Wrapper glc nas-web.add_user command injection

HIGH 81

A vulnerability was detected in GL.iNet GL-MT3000 up to 4.4.5.

CVSS 4.0CRITICAL 9.3 Network No auth No interaction EPSS 0.04731 Published 2026-08-04 No fix listed CWE-74

TI-2026-15311 CVE-2026-18685 · GHSA-frjc-j2mw-rv29

GL.iNet GL-MT3000 modem.so glc set_upgrade command injection

HIGH 81

A security vulnerability has been detected in GL.iNet GL-MT3000 up to 4.4.5.

CVSS 4.0CRITICAL 9.3 Network No auth No interaction EPSS 0.03616 Published 2026-08-03 No fix listed CWE-74

TI-2026-15310 CVE-2026-18684 · GHSA-j682-xx2h-hv5m

GL.iNet GL-MT3000 modem.so glc remove_profile command injection

HIGH 81

A weakness has been identified in GL.iNet GL-MT3000 up to 4.4.5.

CVSS 4.0CRITICAL 9.3 Network No auth No interaction EPSS 0.03616 Published 2026-08-03 No fix listed CWE-74

TI-2026-15259 CVE-2026-18616 · GHSA-39jx-5rpr-2f33

GL-iNet GL-MT3000 wg-server.so Native Plugin glc server.set_peer command injection

HIGH 81

A vulnerability was identified in GL-iNet GL-MT3000 up to 4.4.5.

CVSS 4.0CRITICAL 9.3 Network No auth No interaction EPSS 0.03616 Published 2026-08-03 No fix listed CWE-74

TI-2026-15258 CVE-2026-18615 · GHSA-hh6h-4vwh-4vhf

GL-iNet GL-MT3000 wg-server.so Native Plugin glc wg-server.generate_publickey command injection

HIGH 81

A vulnerability was determined in GL-iNet GL-MT3000 up to 4.4.5.

CVSS 4.0CRITICAL 9.3 Network No auth No interaction EPSS 0.03616 Published 2026-08-03 No fix listed CWE-74

TI-2026-15257 CVE-2026-18614 · GHSA-r4vc-wqp8-j499

GL-iNet GL-MT3000 s2s.so Native Plugin glc s2s.enable_echo_server command injection

HIGH 81

A vulnerability was found in GL-iNet GL-MT3000 up to 4.4.5.

CVSS 4.0CRITICAL 9.3 Network No auth No interaction EPSS 0.03616 Published 2026-08-03 No fix listed CWE-74

TI-2026-15256 CVE-2026-18613 · GHSA-q4qj-7phf-qc9w

GL-iNet GL-MT3000 plugins.so Native Plugin glc plugins.set_config injection

HIGH 81

A vulnerability has been found in GL-iNet GL-MT3000 up to 4.4.5.

CVSS 4.0CRITICAL 9.3 Network No auth No interaction EPSS 0.00995 Published 2026-08-03 No fix listed CWE-707

TI-2026-15255 CVE-2026-18612 · GHSA-jjmc-7j8f-v4hf

GL-iNet GL-MT3000 plugins.so Native Plugin glc plugins.install_package command injection

HIGH 81

A flaw has been found in GL-iNet GL-MT3000 up to 4.4.5.

CVSS 4.0CRITICAL 9.3 Network No auth No interaction EPSS 0.03967 Published 2026-08-03 No fix listed CWE-74

TI-2026-15246 CVE-2026-18602 · GHSA-767p-4fhm-3wpv

GL.iNet GL-MT3000 ovpn-client.so Native Plugin glc ovpn-client.get_recommend_config command injection

HIGH 81

A vulnerability was determined in GL.iNet GL-MT3000 up to 4.4.5.

CVSS 4.0CRITICAL 9.3 Network No auth No interaction EPSS 0.03616 Published 2026-08-03 No fix listed CWE-74

TI-2026-15245 CVE-2026-18601 · GHSA-qv2j-hh7r-m4m2

GL.iNet GL-MT3000 ovpn-client.so Native Plugin glc ovpn-client.check_config command injection

HIGH 81

A vulnerability was found in GL.iNet GL-MT3000 up to 4.4.5.

CVSS 4.0CRITICAL 9.3 Network No auth No interaction EPSS 0.03616 Published 2026-08-03 No fix listed CWE-74

TI-2026-15244 CVE-2026-18600 · GHSA-m56q-x47w-q72w

GL.iNet GL-MT3000 Network Lua RPC Plugin network network.switch_status command injection

HIGH 73

A vulnerability has been found in GL.iNet GL-MT3000 up to 4.4.5.

CVSS 4.0HIGH 8.7 Network Low privileges No interaction EPSS 0.03212 Published 2026-08-03 No fix listed CWE-74

TI-2026-15243 CVE-2026-18599 · GHSA-9x8v-f5rv-67fr

GL.iNet GL-MT3000 Logread Lua RPC Plugin logread logread.set_config command injection

HIGH 72

A flaw has been found in GL.iNet GL-MT3000 up to 4.4.5.

CVSS 4.0HIGH 8.6 Adjacent network Low privileges No interaction EPSS 0.04444 Published 2026-08-03 No fix listed CWE-74

TI-2026-15242 CVE-2026-18598 · GHSA-35v2-77rf-53pc

GL.iNet GL-MT3000 Logread Lua RPC plugin logread logread.get_system_log command injection

HIGH 73

A vulnerability was detected in GL.iNet GL-MT3000 up to 4.4.5.

CVSS 4.0HIGH 8.7 Network Low privileges No interaction EPSS 0.03212 Published 2026-08-03 No fix listed CWE-74

TI-2026-15231 CVE-2026-18585 · GHSA-jrxr-jp3v-2pw6

GL.iNet MT2500 APPS-NAS nas-web.get_file_list heap-based overflow

LOW 25

A vulnerability was detected in GL.iNet MT3000, MT6000, BE9300, BE3600, MT3600BE, E5800, BE6500, MT5000, X3000, XE3000 and MT2500 up to 20260707.

CVSS 4.0MEDIUM 5.3 Network Low privileges No interaction EPSS 0.00509 Published 2026-08-03 No fix listed CWE-119

TI-2026-15230 CVE-2026-18584 · GHSA-ww63-fp7c-4c6q

GL.iNet E5800/E750/X2000/X3000/XE3000/XE300 eSIM LPA API v1 improper authorization

LOW 24

A security vulnerability has been detected in GL.iNet E5800, E750, X2000, X3000, XE3000 and XE300 up to 20260707.

CVSS 4.0MEDIUM 5.3 Adjacent network No auth No interaction EPSS 0.00352 Published 2026-08-03 No fix listed CWE-266

TI-2026-10479 CVE-2026-12187 · GHSA-8rqp-5vg5-cv68

GL.iNet GL-MT3000 Online Firmware Upgrade one_click_upgrade command injection

HIGH 73

A security vulnerability has been detected in GL.iNet GL-MT3000 up to 4.4.5.

CVSS 4.0HIGH 8.7 Network Low privileges No interaction EPSS 0.0194 Published 2026-06-14 Fixed in 4.7 CWE-74

TI-2026-10478 CVE-2026-12186 · GHSA-8x52-x2jf-947x

GL.iNet GL-MT3000 Tor Proxy Service Configuration tor replace_country command injection

HIGH 73

A weakness has been identified in GL.iNet GL-MT3000 up to 4.4.5.

CVSS 4.0HIGH 8.7 Network Low privileges No interaction EPSS 0.01966 Published 2026-06-14 Fixed in 4.7 CWE-74

TI-2026-09934 CVE-2026-11505 · GHSA-2r8p-5hq4-h3r4

GL.iNet XE3000 glnassys hard-coded key

LOW 11

A flaw has been found in GL.iNet A1300, AX1800, AXT1800, MT2500, MT3000, MT6000, X3000 and XE3000 4.8.x.

CVSS 4.0LOW 2.3 Network Low privileges No interaction EPSS 0.00197 Published 2026-06-08 Fixed in 4.9.0 CWE-320

TI-2026-09881 CVE-2026-11452 · GHSA-5qf6-3rw8-7jgg

GL.iNet GL-MT3000 SET_USER_PWD glc FUN_0042e200 command injection

MEDIUM 40

A vulnerability has been found in GL.iNet GL-MT3000 up to 4.4.5.

CVSS 4.0MEDIUM 6.9 Network No auth No interaction EPSS 0.01849 Published 2026-06-07 Fixed in 4.8.1 CWE-74

Vulnerabilities

Filters