CVE-2026-19980: falha de média gravidade em GL.iNet XE3000
GL.iNet XE3000 Language Update ui.update_langs code injection
Publicada em · Atualizada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
13Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 5.3epss 0.4%
A security flaw has been discovered in GL.iNet A1300, AX1800, AXT1800, BE1400, BE3600, BE6500, BE9300, BE10000, E5800, MT2500, MT3000, MT3600BE, MT5000, MT6000, X2000, X3000 and XE3000 up to 4.8.x. Affected by this issue is the function ui.update_langs of the component Language Update. Performing a manipulation of the argument hour/min/week results in code injection. The attack can be initiated remotely. The vendor explains: "After our investigation, we have confirmed that the vulnerability described (...) does indeed exist."
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:L/SI:L/SA:L/E:X
Produtos afetados
GL.iNet · A1300GL.iNet · AX1800GL.iNet · AXT1800GL.iNet · BE10000GL.iNet · BE1400GL.iNet · BE3600GL.iNet · BE6500GL.iNet · BE9300GL.iNet · E5800GL.iNet · MT2500GL.iNet · MT3000GL.iNet · MT3600BEGL.iNet · MT5000GL.iNet · MT6000GL.iNet · X2000GL.iNet · X3000GL.iNet · XE3000CVEs relacionadas — GL.iNet XE3000
No mesmo produto, das mais perigosas para as menos.
CVE-2026-18787HIGHGL.iNet AX1800 RPC Endpoint oui-rpc.lua remove_rule command injectionEPSS 3.2%CVE-2026-19983MEDIUMGL.iNet XE3000 NAS Command Service gl_nas_sys os command injectionEPSS 2.1%CVE-2026-19981MEDIUMGL.iNet XE3000 Wi-Fi Timer Power-Schedule Feature os command injectionEPSS 1.8%CVE-2026-19979MEDIUMGL.iNet XE3000 WebDAV Service MOVE authorizationEPSS 0.5%CVE-2026-11505LOWGL.iNet XE3000 glnassys hard-coded keyEPSS 0.2%