CVE-2026-19979mediumCWE-285CWE-639

CVE-2026-19979: medium-severity vulnerability in GL.iNet XE3000

GL.iNet XE3000 WebDAV Service MOVE authorization

Published · Updated

Follow this CVE+ Monitor MT3000+ Monitor MT6000

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

13Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 6.9epss 0.5%
A vulnerability was identified in GL.iNet A1300, AX1800, AXT1800, BE1400, BE3600, BE6500, BE9300, BE10000, E5800, MT2500, MT3000, MT3600BE, MT5000, MT6000, X2000, X3000 and XE3000 up to 4.8.x. Affected by this vulnerability is the function COPY/MOVE of the component WebDAV Service. Such manipulation leads to authorization bypass. It is possible to launch the attack remotely. The vendor explains: "After our investigation, we have confirmed that the vulnerability described (...) does indeed exist."
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:L/SI:L/SA:L/E:X
Affected products
GL.iNet · A1300GL.iNet · AX1800GL.iNet · AXT1800GL.iNet · BE10000GL.iNet · BE1400GL.iNet · BE3600GL.iNet · BE6500GL.iNet · BE9300GL.iNet · E5800GL.iNet · MT2500GL.iNet · MT3000GL.iNet · MT3600BEGL.iNet · MT5000GL.iNet · MT6000GL.iNet · X2000GL.iNet · X3000GL.iNet · XE3000
Related CVEs — GL.iNet XE3000

In the same product, most dangerous first.

CVE-2026-18787HIGHGL.iNet AX1800 RPC Endpoint oui-rpc.lua remove_rule command injectionEPSS 3.2%CVE-2026-19983MEDIUMGL.iNet XE3000 NAS Command Service gl_nas_sys os command injectionEPSS 2.1%CVE-2026-19981MEDIUMGL.iNet XE3000 Wi-Fi Timer Power-Schedule Feature os command injectionEPSS 1.8%CVE-2026-19980MEDIUMGL.iNet XE3000 Language Update ui.update_langs code injectionEPSS 0.4%CVE-2026-11505LOWGL.iNet XE3000 glnassys hard-coded keyEPSS 0.2%