CVE-2026-19981 in A1300
Summary
by MITRE • 08/17/2026
A weakness has been identified in GL.iNet A1300, AX1800, AXT1800, BE1400, BE3600, BE6500, BE9300, BE10000, E5800, MT2500, MT3000, MT3600BE, MT5000, MT6000, X2000, X3000 and XE3000 up to 4.8.x. This affects an unknown part of the component Wi-Fi Timer Power-Schedule Feature. Executing a manipulation of the argument switch_power/restore_power can lead to os command injection. The attack can be launched remotely. The vendor explains: "After our investigation, we have confirmed that the vulnerability described (...) does indeed exist."
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 08/17/2026
The identified security flaw resides within the Wi-Fi Timer Power-Schedule feature of various GL.iNet router models including the A1300, AX1800, AXT1800, BE series, MT series, and X series devices running firmware versions up to 4.8.x. This vulnerability specifically impacts the handling of arguments passed to the switch_power or restore_power functions within the device's administrative interface. The core technical deficiency is a failure to properly sanitize user-supplied input before it is processed by underlying system commands. When an attacker manipulates these specific argument switches, they can inject arbitrary operating system commands into the execution context of the router. This type of flaw is classically categorized under CWE-78 Improper Neutralization of Special Elements used in an OS Command, commonly known as OS command injection. The vulnerability arises because the application does not adequately validate or escape special characters that have significance to the shell environment, allowing malicious payloads to break out of intended function boundaries and execute with the privileges of the compromised service.
The operational impact of this vulnerability is severe due to its remote exploitability without authentication in many configurations where administrative access might be exposed or if other pre-authentication vectors exist. An attacker can leverage this flaw to gain unauthorized control over the router's operating system, effectively achieving full device compromise. This level of access allows for a wide range of malicious activities including but not limited to installing persistent backdoors, pivoting attacks into internal network segments by manipulating routing tables or firewall rules, intercepting and modifying unencrypted traffic passing through the gateway, and using the compromised hardware as part of a botnet infrastructure such as Mirai variants. The ability to execute arbitrary commands means that an attacker can completely subvert the integrity, confidentiality, and availability of both the router itself and any devices connected to it. This aligns with ATT&CK techniques related to Command and Scripting Interpreter abuse, specifically T1059 which covers execution via various scripting languages or shell environments available on embedded Linux systems commonly found in IoT routers.
Vendor confirmation indicates that GL.iNet has acknowledged the existence of this vulnerability following their internal investigation. To mitigate this risk, users should immediately update their router firmware to a version released after the patch for CVE-2024-3987 or its equivalent identifier if applicable, ensuring that all known fixes are applied. If updating is not immediately possible, administrators should restrict access to the management interface by disabling remote administration features and placing the device behind additional network security controls such as firewalls with strict ingress filtering rules. It is also advisable to change default credentials and disable unused services like Telnet or SSH if they are enabled but not required for operation. Continuous monitoring of vendor release notes and participating in vulnerability disclosure programs can help ensure timely remediation of similar issues across the IoT ecosystem, reducing the attack surface presented by these widely deployed networking devices.