GL.iNet XE3000 WebDAV Service MOVE authorization

published 2026-08-17 2 mo ago modified 2026-08-20 2 mo ago also EUVD-2026-60039

cvss: 8.3; version 3.1, CNA
cisa kev: Not listed; not in CISA's catalog
epss: 0.5%; EPSS 0.5% chance of exploitation in 30 days, percentile 45%
public exploits: 0; none known

A vulnerability was identified in GL.iNet A1300, AX1800, AXT1800, BE1400, BE3600, BE6500, BE9300, BE10000, E5800, MT2500, MT3000, MT3600BE, MT5000, MT6000, X2000, X3000 and XE3000 up to 4.8.x. Affected by this vulnerability is the function COPY/MOVE of the component WebDAV Service. Such manipulation leads to authorization bypass. It is possible to launch the attack remotely. The vendor explains: "After our investigation, we have confirmed that the vulnerability described (...) does indeed exist."

CISA SSVC

Exploitation: none
Automatable: yes
Technical impact: partial
Assessed: 2 mo ago (2026-08-18)

Exploit prediction

0.54% chance of exploitation in the next 30 days, higher than 45% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by	version	score	vector
CNA	4.0	6.9	CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:L/SI:L/SA:L/E:X
CNA	3.1	8.3	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L/E:X/RL:X/RC:R
CNA	3.0	8.3	CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L/E:X/RL:X/RC:R
CNA	2.0	7.5	AV:N/AC:L/Au:N/C:P/I:P/A:P/E:ND/RL:ND/RC:UR
CNA	4.0	6.9	CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:L/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
CNA	3.1	8.3	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L
CNA	2.0	7.5	AV:N/AC:L/Au:N/C:P/I:P/A:P

Affected products

GL.iNet A1300
GL.iNet AX1800
GL.iNet AXT1800
GL.iNet BE1400
GL.iNet BE3600
GL.iNet BE6500
GL.iNet BE9300
GL.iNet BE10000
GL.iNet E5800
GL.iNet MT2500
GL.iNet MT3000
GL.iNet MT3600BE
GL.iNet MT5000
GL.iNet MT6000
GL.iNet X2000
GL.iNet X3000
GL.iNet XE3000

Classification

Weakness

CWE-639 Authorization Bypass Through User-Controlled Key
CWE-285 Improper Authorization

References

vuldb.com /vuln/391161
vdb-entry, technical-description
vuldb.com /vuln/391161/cti
signature, permissions-required
vuldb.com /cve/CVE-2026-19979
third-party-advisory
vuldb.com /submit/873915
third-party-advisory
github.com /gl-inet/CVE-issues/blob/main/4.0.0/WebDAV%20Public-Share%20Destination%20Authorization%20Bypass.md
related

Sources

CVE List CVE-2026-19979
NVD CVE-2026-19979

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

Summary