CVE-2026-19981: GL.iNet XE3000 Wi-Fi Timer Power-Schedule Feature os command injection
A weakness has been identified in GL.iNet A1300, AX1800, AXT1800, BE1400, BE3600, BE6500, BE9300, BE10000, E5800, MT2500, MT3000, MT3600BE, MT5000, MT6000, X2000, X3000 and XE3000 up to 4.8.x. This affects an unknown part of the component Wi-Fi Timer Power-Schedule Feature. Executing a manipulation of the argument switchpower/restorepower can lead to os command injection. The attack can be launched remotely. The vendor explains: "After our investigation, we have confirmed that the vulnerability described (...) does indeed exist."
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-19981?
CVE-2026-19981 has a severity rating of 7.4, categorized as high.
What devices are affected by CVE-2026-19981?
CVE-2026-19981 impacts multiple GL.iNet devices including A1300, AX1800, AXT1800, and others up to firmware version 4.8.x.
How does CVE-2026-19981 exploit the system?
CVE-2026-19981 allows an attacker to perform OS command injection through the Wi-Fi Timer Power-Schedule Feature.
How can I mitigate the risk of CVE-2026-19981?
Mitigation for CVE-2026-19981 involves updating the firmware of affected GL.iNet devices to a fixed version.
What is the potential impact of CVE-2026-19981?
CVE-2026-19981 can lead to unauthorized command execution, potentially compromising the integrity and availability of the device.