OS Command Injection Vulnerability in GL.iNet Router Products
CVE-2026-19983

6.9MEDIUM

Key Information:

Vendor

Gl.inet

Status
A1300
Ax1800
Axt1800
Mt2500
Vendor
CVE Published:
17 August 2026

What is CVE-2026-19983?

A remote code execution vulnerability has been identified in multiple models of GL.iNet routers due to improper handling of the NAS Command Service. Specifically, the issue arises in the /usr/bin/gl_nas_sys file within the 4.8.x series. Attackers could exploit this flaw to execute arbitrary commands on affected devices. It is strongly recommended to upgrade to version 4.9.0 to mitigate this risk.

Affected Version(s)

A1300 4.8.*

AX1800 4.8.*

AXT1800 4.8.*

References

https://vuldb.com/vuln/391165
vdb-entry
https://vuldb.com/vuln/391165/cti
signaturepermissions-required
https://vuldb.com/cve/CVE-2026-19983
third-party-advisory

CVSS V4

Score:
6.9
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

GLiNet (VulDB User)
VulDB CNA Team
.