A flaw in the WebDAV component’s COPY and MOVE functions allows an attacker to bypass authorization controls, enabling unauthorized manipulation of files on the device. The vulnerability can be exploited remotely through specially crafted WebDAV requests. Although the vendor does not detail the full extent of the impact, the ability to move or copy files without proper authentication could lead to disclosure or alteration of sensitive configuration and firmware data.

All GL.iNet routers listed in the CNA vendor/product table—namely the A1300, AX1800, AXT1800, BE10000, BE1400, BE3600, BE6500, BE9300, E5800, MT2500, MT3000, MT3600BE, MT5000, MT6000, X2000, X3000, and XE3000—are potentially vulnerable on firmware versions up to 4.8.x. Exact version boundaries are not specified beyond the 4.8.x ceiling.

The CVSS score of 6.9 indicates a moderate severity, while the EPSS is unavailable, implying unknown exploitation likelihood. The vulnerability is not listed in CISA's KEV catalog. Because the flaw is exploitable remotely via HTTP requests directed at the WebDAV service, an attacker only needs network access to the device, with no local privileges required. Successful exploitation would give the actor the ability to read, modify, or delete arbitrary files through the MOVE and COPY operations, potentially compromising device configuration and integrity.