GL.iNet XE3000 Wi-Fi Timer Power-Schedule Feature os command injection

published 2026-08-17 2 mo ago modified 2026-08-20 2 mo ago also EUVD-2026-60041

cvss: 7.4; version 3.1, CNA
cisa kev: Not listed; not in CISA's catalog
epss: 1.8%; EPSS 1.8% chance of exploitation in 30 days, percentile 78%
public exploits: 0; none known

A weakness has been identified in GL.iNet A1300, AX1800, AXT1800, BE1400, BE3600, BE6500, BE9300, BE10000, E5800, MT2500, MT3000, MT3600BE, MT5000, MT6000, X2000, X3000 and XE3000 up to 4.8.x. This affects an unknown part of the component Wi-Fi Timer Power-Schedule Feature. Executing a manipulation of the argument switch_power/restore_power can lead to os command injection. The attack can be launched remotely. The vendor explains: "After our investigation, we have confirmed that the vulnerability described (...) does indeed exist."

CISA SSVC

Exploitation: none
Automatable: no
Technical impact: partial
Assessed: 2 mo ago (2026-08-17)

Exploit prediction

1.77% chance of exploitation in the next 30 days, higher than 78% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by	version	score	vector
CNA	4.0	5.3	CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:L/SI:L/SA:L/E:X
CNA	3.1	7.4	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L/E:X/RL:X/RC:R
CNA	3.0	7.4	CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L/E:X/RL:X/RC:R
CNA	2.0	6.5	AV:N/AC:L/Au:S/C:P/I:P/A:P/E:ND/RL:ND/RC:UR
CNA	4.0	5.3	CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:L/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
CNA	3.1	7.4	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L
CNA	2.0	6.5	AV:N/AC:L/Au:S/C:P/I:P/A:P

Affected products

GL.iNet A1300
GL.iNet AX1800
GL.iNet AXT1800
GL.iNet BE1400
GL.iNet BE3600
GL.iNet BE6500
GL.iNet BE9300
GL.iNet BE10000
GL.iNet E5800
GL.iNet MT2500
GL.iNet MT3000
GL.iNet MT3600BE
GL.iNet MT5000
GL.iNet MT6000
GL.iNet X2000
GL.iNet X3000
GL.iNet XE3000

Classification

Weakness

CWE-78 Improper Neutralization of Special Elements used in an OS Command
CWE-77 Improper Neutralization of Special Elements used in a Command

References

vuldb.com /vuln/391163
vdb-entry, technical-description
vuldb.com /vuln/391163/cti
signature, permissions-required
vuldb.com /cve/CVE-2026-19981
third-party-advisory
vuldb.com /submit/873917
third-party-advisory
github.com /gl-inet/CVE-issues/blob/main/4.0.0/Wi-Fi%20Timer%20Power-Schedule%20Cron%20RCE.md
related

Sources

CVE List CVE-2026-19981
NVD CVE-2026-19981

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

Summary