CVE-2026-19980
HighCVSS 7.4Exploitation Probability (EPSS)
Low risk14th percentile - higher than 14% of all known CVEs
Summary
A vulnerability was detected in multiple GL.iNet devices (including A1300, AX1800, BE9300, MT6000) up to version 4.8.x. The issue affects the ui.update_langs function in the Language Update component, where manipulation of hour/min/week arguments leads to code injection. The attack can be initiated remotely.
Risk Assessment
A remote attacker can inject and execute arbitrary code, potentially leading to device takeover and network security compromise.
Recommendation
Upgrade the devices to the latest firmware version that addresses the vulnerability.
Original NVD description (English source)
A security flaw has been discovered in GL.iNet A1300, AX1800, AXT1800, BE1400, BE3600, BE6500, BE9300, BE10000, E5800, MT2500, MT3000, MT3600BE, MT5000, MT6000, X2000, X3000 and XE3000 up to 4.8.x. Affected by this issue is the function ui.update_langs of the component Language Update. Performing a manipulation of the argument hour/min/week results in code injection. The attack can be initiated remotely. The vendor explains: "After our investigation, we have confirmed that the vulnerability described (...) does indeed exist."