Firewall Management RPC Vulnerability in GL.iNet BE9300 and MT6000
CVE-2026-19982

5.3MEDIUM

Key Information:

Vendor

Gl.inet

Status
Be9300
Mt6000
Vendor
CVE Published:
17 August 2026

What is CVE-2026-19982?

A vulnerability exists in the firewall management RPC of GL.iNet BE9300 and MT6000 devices running version 4.8.x, allowing attackers to perform OS command injections via manipulated dest_port and dest_ip parameters. This attack can be executed remotely, leading to potentially severe security risks. Users are advised to upgrade to version 4.9.0 to resolve this issue effectively. The vendor has confirmed the presence of the vulnerability following their investigation.

Affected Version(s)

BE9300 4.8.*

MT6000 4.8.*

BE9300 4.9.0

References

https://vuldb.com/vuln/391164
vdb-entrytechnical-description
https://vuldb.com/vuln/391164/cti
signaturepermissions-required
https://vuldb.com/cve/CVE-2026-19982
third-party-advisory

CVSS V4

Score:
5.3
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

GLiNet (VulDB User)
VulDB CNA Team
.