The flaw resides in the glnassys component of multiple GL.iNet routers and involves a hard‑coded cryptographic key. Manipulation of this component can cause the device to rely on the fixed key, potentially undermining normal authentication controls. The weakness is classified as CWE‑320 and CWE‑321, indicating poor password management and weak key usage. Because the exploit is reported to require a high level of complexity and is described as difficult, the immediate risk to confidentiality, integrity, and availability is low but not negligible.

The vulnerability affects GL.iNet A1300, AX1800, AXT1800, MT2500, MT3000, MT6000, X3000, and XE3000 routers running firmware version 4.8.x. All listed device families contain the glnassys component with the hard‑coded key.

The CVSS score of 2.3 indicates a low‑severity issue. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog, suggesting no known widespread active exploitation. Attacks may be launched remotely, but the exploitation is deemed difficult and requires significant expertise. The attack vector is not further specified in the advisory, so the exact remote interface involved remains unspecified.