CVE-2026-19980 in A1300
Summary
by MITRE • 08/17/2026
A security flaw has been discovered in GL.iNet A1300, AX1800, AXT1800, BE1400, BE3600, BE6500, BE9300, BE10000, E5800, MT2500, MT3000, MT3600BE, MT5000, MT6000, X2000, X3000 and XE3000 up to 4.8.x. Affected by this issue is the function ui.update_langs of the component Language Update. Performing a manipulation of the argument hour/min/week results in code injection. The attack can be initiated remotely. The vendor explains: "After our investigation, we have confirmed that the vulnerability described (...) does indeed exist."
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 08/17/2026
A critical remote code execution vulnerability has been identified within the firmware of numerous GL.iNet router models including the A1300, AX1800, AXT1800, BE series, MT series, and X series devices running version 4.8.x or earlier. This flaw resides specifically in the ui.update_langs function associated with the Language Update component of the device's web management interface. The vulnerability stems from insufficient input validation when processing arguments related to time intervals such as hour, minute, or week settings. An attacker can exploit this weakness by manipulating these specific parameters to inject arbitrary commands into the underlying system shell. This represents a classic instance of command injection where user-supplied data is executed without proper sanitization, allowing for unauthorized control over the device's operating environment.
The technical nature of this flaw aligns with CWE-78 Improper Neutralization of Special Elements used in an OS Command commonly known as OS Command Injection. The vulnerability allows a remote attacker to execute system commands with the privileges of the web server process running on the router. This capability fundamentally compromises the integrity and availability of the network infrastructure managed by these devices. By leveraging this injection point, an adversary can potentially install persistent backdoors, exfiltrate sensitive data such as Wi-Fi credentials or connected device information, pivot to other systems within the local network, or disrupt service through denial-of-service attacks. The impact is severe because routers often serve as gateways for entire home or small business networks, making them high-value targets for botnet recruitment and lateral movement campaigns.
From a threat intelligence perspective this vulnerability maps directly to MITRE ATT&CK technique T1059 Command and Scripting Interpreter specifically the Unix Shell sub-technique which describes how attackers use command line interfaces to execute malicious commands on compromised systems. The ability to initiate attacks remotely without authentication significantly lowers the barrier for exploitation enabling automated scanning tools to compromise vulnerable devices at scale. This characteristic is typical of Internet-facing IoT appliances that expose administrative interfaces directly to public networks or rely on weak default configurations. The confirmation by GL.iNet validates the existence of this flaw and underscores the necessity for immediate remediation actions across all affected product lines.
Mitigation strategies must prioritize updating firmware to versions released after the disclosure where input validation mechanisms have been strengthened in the ui.update_langs function. Administrators should verify that their devices are running patched releases provided by GL.iNet which address the improper handling of time-related arguments. In environments where immediate patching is not feasible restricting access to the web management interface via firewall rules or VLAN segmentation can reduce exposure to untrusted networks. Additionally disabling remote administration features and enforcing strong authentication policies further limits the attack surface available to potential adversaries. Regular monitoring for unusual outbound network traffic from these devices may also help detect exploitation attempts before significant damage occurs ensuring continued operational security of the connected infrastructure.