CVE-2026-19982 in BE9300
Summary
by MITRE • 08/17/2026
A security vulnerability has been detected in GL.iNet BE9300 and MT6000 4.8.x. This vulnerability affects unknown code of the component Firewall-management RPC. The manipulation of the argument dest_port/dest_ip leads to os command injection. The attack may be initiated remotely. Upgrading to version 4.9.0 is able to resolve this issue. The affected component should be upgraded. The vendor explains: "After our investigation, we have confirmed that the vulnerability described (...) does indeed exist."
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 08/17/2026
A critical remote code execution vulnerability has been identified within the GL.iNet BE9300 and MT6000 routers running firmware version 4.8.x. This flaw resides in the Firewall-management RPC component, specifically affecting how input arguments are processed before being passed to underlying system commands. The vulnerability is classified as an operating system command injection, which allows an attacker to execute arbitrary commands on the target device with the privileges of the affected service process. This represents a severe security risk because it compromises the integrity and availability of the network infrastructure managed by these routers.
The technical root cause lies in improper neutralization of special elements used in operating system commands within the dest_port and dest_ip arguments. When user-supplied data is received via the RPC interface, the application fails to adequately sanitize or validate this input before concatenating it into shell command strings. This lack of proper validation allows an attacker to inject malicious payloads that break out of the intended context and execute additional operating system commands. The vulnerability aligns with CWE-78 Improper Neutralization of Special Elements used in an OS Command, a common flaw in applications that interact directly with the host operating system without sufficient input filtering or parameterized command execution strategies.
The operational impact of this vulnerability is significant due to its remote nature and high severity. An unauthenticated attacker can exploit this weakness over the network by sending specially crafted RPC requests containing malicious dest_port or dest_ip values. Successful exploitation grants the attacker full control over the router's operating system, potentially leading to complete compromise of the device. This could result in unauthorized access to sensitive data, use of the router as a pivot point for further attacks within the local network, installation of persistent backdoors, or disruption of network services through denial-of-service conditions. The ability to execute commands remotely without authentication makes this particularly dangerous in environments where these routers serve as gateways to internal networks.
This vulnerability is associated with MITRE ATT&CK technique T1059 Command and Scripting Interpreter, specifically under the sub-technique for OS command scripts. Attackers can leverage this capability to perform lateral movement within a network or establish persistence by modifying system configurations or installing malicious binaries. The remote exploitability means that no physical access or prior authentication is required, lowering the barrier for entry significantly compared to vulnerabilities requiring local access or valid credentials.
To mitigate this risk, immediate action is required from administrators of GL.iNet BE9300 and MT6000 devices running version 4.8.x. The vendor has confirmed the existence of this vulnerability and released a patch in firmware version 4.9.0 which addresses the input validation issues within the Firewall-management RPC component. Upgrading to this latest version is the primary recommended mitigation strategy as it resolves the underlying code flaws that allow command injection. Organizations should prioritize updating their affected devices to ensure they are protected against remote exploitation attempts. Additionally, until patches can be applied, network segmentation and strict firewall rules limiting access to management interfaces from untrusted networks may provide some limited protection by reducing the attack surface available to potential adversaries.