Code Injection Vulnerability in GL.iNet Routers and Products
CVE-2026-19980

5.3MEDIUM

Key Information:

Vendor

Gl.inet

Status
A1300
Ax1800
Axt1800
Be1400
Vendor
CVE Published:
17 August 2026

What is CVE-2026-19980?

A security vulnerability has been identified in various GL.iNet router models related to the function ui.update_langs in the Language Update component. This flaw allows for a remote code injection attack by manipulating the hour/min/week parameters, potentially compromising the device. The vendor has acknowledged the existence of this vulnerability following an internal investigation.

Affected Version(s)

A1300 4.0

A1300 4.1

A1300 4.2

References

https://vuldb.com/vuln/391162
vdb-entrytechnical-description
https://vuldb.com/vuln/391162/cti
signaturepermissions-required
https://vuldb.com/cve/CVE-2026-19980
third-party-advisory

CVSS V4

Score:
5.3
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

GLiNet (VulDB User)
VulDB CNA Team
.