A heap‑based buffer overflow exists in the nas‑web.get_file_list function of the APPS‑NAS module. The vulnerability can be triggered by sending a specially crafted request, causing the application to corrupt memory and crash. The result is a denial of service that can be executed from a remote location, indicating that the flaw is exploitable without disclosure of additional details. The weakness is classified as CWE-119 and CWE-122, indicating untrusted input handling and improper bounds checking.

GL.iNet devices BE3600, BE6500, BE9300, E5800, MT2500, MT3000, MT3600BE, MT5000, MT6000, X3000, and XE3000, with affected firmware versions up to the release dated 2026‑07‑07. The vulnerability is present in all listed models’ APPS‑NAS module before this date.

The CVSS v3 score is 5.3, reflecting moderate severity. EPSS data is unavailable and the flaw is not listed in the CISA KEV catalog, suggesting limited known exploitation. The description states that the attack may be initiated remotely by submitting a manipulated request to nas‑web.get_file_list; the CVE payload does not specify any particular authentication or privilege requirements, so it is unclear whether the exploit requires valid credentials or can be performed by unauthenticated users. Once triggered, the buffer overflow causes the service to crash, leading to unavailability of the NAS functionality until the device is rebooted or patched.