CVE-2026-19979 in A1300
Summary
by MITRE • 08/17/2026
A vulnerability was identified in GL.iNet A1300, AX1800, AXT1800, BE1400, BE3600, BE6500, BE9300, BE10000, E5800, MT2500, MT3000, MT3600BE, MT5000, MT6000, X2000, X3000 and XE3000 up to 4.8.x. Affected by this vulnerability is the function COPY/MOVE of the component WebDAV Service. Such manipulation leads to authorization bypass. It is possible to launch the attack remotely. The vendor explains: "After our investigation, we have confirmed that the vulnerability described (...) does indeed exist."
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 08/24/2026
The identified security flaw resides within the WebDAV service implementation of GL.iNet router firmware versions up to 4.8.x across a wide range of hardware models including the A1300, AX1800, AXT1800, BE series, MT series, and X series devices. This vulnerability specifically affects the COPY and MOVE operations handled by the WebDAV component, which is commonly used for remote file management over HTTP-based protocols. The core technical issue stems from an authorization bypass mechanism where the system fails to properly validate user privileges before executing these file manipulation commands. In a secure implementation, any operation that modifies the filesystem structure or content must be strictly gated behind robust authentication and access control checks. However, in this affected firmware version, the logic governing COPY and MOVE requests allows unauthenticated or improperly authenticated actors to execute these functions, effectively treating them as if they were performed by an administrator with full system rights.
From a technical perspective, this flaw represents a classic case of broken access control where the application does not enforce proper restrictions on unauthorized users attempting to perform privileged actions. The WebDAV protocol extends HTTP methods such as COPY and MOVE, which are typically used for file management tasks like renaming or relocating files within a directory structure. When these operations lack adequate authorization checks, an attacker can manipulate the underlying filesystem of the router. This could involve moving critical configuration files, overwriting system binaries, or creating unauthorized directories that facilitate further exploitation. The vulnerability is remotely exploitable, meaning it does not require physical access to the device or prior network authentication beyond what might be required to reach the WebDAV service endpoint itself.
The operational impact of this authorization bypass is severe due to the central role routers play in home and small business networks. An attacker leveraging this flaw could gain unauthorized control over the router's file system, potentially leading to complete compromise of the device. This includes the ability to modify DNS settings to redirect traffic through malicious servers, install persistent backdoors or malware within the firmware storage, or disrupt network connectivity by altering routing tables and firewall rules. Furthermore, because these routers often serve as gateways for multiple devices on a local network, compromising one unit can expose all connected endpoints to interception, man-in-the-middle attacks, and data exfiltration. The ability to move files also suggests potential for privilege escalation if critical system binaries are replaced with malicious counterparts that execute during boot or service restarts.
This vulnerability aligns closely with CWE-287 Improper Authentication and CWE-928 Improper Authorization in OWASP categories, as the root cause is the failure to verify user identity and permissions before allowing state-changing operations. In terms of MITRE ATT&CK mapping, this behavior corresponds to T1053 Scheduled Task/Job which may be leveraged for persistence if malicious scripts are moved into executable directories, or more broadly under Initial Access techniques that exploit web services. The remote nature of the attack vector places it within the context of network-based exploitation strategies where attackers target exposed management interfaces.
Mitigation requires immediate action from both vendors and users. GL.iNet has confirmed the existence of this vulnerability through internal investigation, indicating that a patch or firmware update addressing these authorization checks is likely being developed or released. Users should monitor official vendor channels for updated firmware versions that explicitly state they have remediated issues related to WebDAV service authorization bypasses. Until such updates are applied and deployed, administrators should consider disabling the WebDAV service entirely if it is not strictly necessary for their operational workflow. Additionally, ensuring that management interfaces are not exposed directly to untrusted networks via proper firewall rules can reduce the attack surface. Regular auditing of router configurations and monitoring for unusual file system changes or network traffic anomalies associated with HTTP-based file transfers can also help in detecting potential exploitation attempts early.