GL.iNet 4.9.0 Fixes Five RCE Flaws in Wi-Fi Routers

GL.iNet has confirmed and patched five vulnerabilities in firmware 4.8.x — four remote code execution flaws and one authorization bypass — all with public proof-of-concept code. The fix is firmware 4.9.0, available now. If you’re running 4.8.x on any of the affected models, this is a straightforward call: update and move on.

The five CVEs

CVE-2026-19983 — CVSS 8.3, High

The most severe of the batch. An unauthenticated host-header manipulation in the NAS command service (/usr/bin/gl_nas_sys) allows remote code execution as root with no credentials required. Affected models: A1300, AX1800, AXT1800, MT2500, MT3000, MT6000, X3000, XE3000. Vendor advisory.

CVE-2026-19979 — CVSS 8.3, High

Authorization bypass in the WebDAV service’s COPY and MOVE operations. An attacker can redirect file operations outside the intended public-share scope without authentication. Affects the widest device list of the five: A1300, AX1800, AXT1800, BE1400, BE3600, BE6500, BE9300, BE10000, E5800, MT2500, MT3000, MT3600BE, MT5000, MT6000, X2000, X3000, XE3000. Vendor advisory.

CVE-2026-19982 — CVSS 7.4, High

OS command injection via dest_port/dest_ip arguments in the firewall-management RPC. Affects the BE9300 and MT6000. Vendor advisory.

CVE-2026-19981 — CVSS 7.4, High

OS command injection via switch_power/restore_power arguments in the Wi-Fi Timer Power-Schedule feature. Affects seventeen models across the product line. Vendor advisory.

CVE-2026-19980 — CVSS 7.4, High

Code injection through hour/min/week arguments in the language auto-update scheduler (ui.update_langs). Same broad device list as CVE-2026-19981. Vendor advisory.

None of these are currently on the CISA Known Exploited Vulnerabilities catalog. That can change — public PoC exists for all five, which is the condition that typically precedes opportunistic exploitation.

Affected devices

Across all five CVEs, the vulnerable firmware line (4.8.x) covers:

A1300, AX1800, AXT1800, BE1400, BE3600, BE6500, BE9300, BE10000, E5800, MT2500, MT3000, MT3600BE, MT5000, MT6000, X2000, X3000, XE3000.

Not every device is in scope for every CVE — the NAS RCE (CVE-2026-19983) and firewall RCE (CVE-2026-19982) have narrower device lists, while the WebDAV bypass and the scheduler flaws hit the full range above.

What to do

Update to GL.iNet firmware 4.9.0.

Log in to the admin panel, go to System → Upgrade, and apply the update. GL.iNet’s mobile app also supports firmware upgrades. The vendor’s 4.9.0 release page lists firmware packages by device.

Check your admin panel exposure at the same time. The unauthenticated NAS RCE (CVE-2026-19983) doesn’t require LAN position — it’s remotely exploitable. If your router’s admin interface is reachable from the WAN, restrict it to the LAN interface only (under System → Administration → Access Methods in most GL.iNet firmware versions).

Priority call

CVE-2026-19983 tops the list — unauthenticated root RCE is as bad as it gets, and with a public PoC, the window between “vulnerability disclosed” and “actively scanned” is short. The four remaining flaws at CVSS 7.4 are all remotely exploitable with public PoC as well.

Patch now. This is not a maintenance-window situation for any device that sits at a network edge or handles traffic from untrusted sources.

For context on other router-class vulnerabilities patched recently, see OpenWRT LuCI critical root RCE and the Evooo1Bot botnet targeting routers for SOCKS5 relay.