OS Command Injection Vulnerability in GL.iNet Routers
CVE-2026-19981

5.3MEDIUM

Key Information:

Vendor

Gl.inet

Status
A1300
Ax1800
Axt1800
Be1400
Vendor
CVE Published:
17 August 2026

What is CVE-2026-19981?

A security issue has been detected in various GL.iNet router models related to their Wi-Fi Timer Power-Schedule feature. By manipulating the arguments switch_power or restore_power, attackers can execute OS commands, potentially compromising the device. This vulnerability is exploitable remotely and poses a significant risk, emphasizing the need for prompt attention by users of the affected models to ensure their devices are updated and secure.

Affected Version(s)

A1300 4.0

A1300 4.1

A1300 4.2

References

https://vuldb.com/vuln/391163
vdb-entrytechnical-description
https://vuldb.com/vuln/391163/cti
signaturepermissions-required
https://vuldb.com/cve/CVE-2026-19981
third-party-advisory

CVSS V4

Score:
5.3
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

GLiNet (VulDB User)
VulDB CNA Team
.