Description
A vulnerability was detected in GL.iNet A1300, AX1800, AXT1800, MT2500, MT3000, MT6000, X3000 and XE3000 4.8.x. This issue affects some unknown processing of the file /usr/bin/gl_nas_sys of the component NAS Command Service. The manipulation results in os command injection. The attack may be launched remotely. Upgrading to version 4.9.0 is capable of addressing this issue. It is suggested to upgrade the affected component. The vendor explains: "After our investigation, we have confirmed that the vulnerability described (...) does indeed exist."
Published: 2026-08-17
Score: 6.9 Medium
EPSS: n/a
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

An OS command injection flaw exists in the NAS Command Service component that processes the file /usr/bin/gl_nas_sys. The flaw allows an attacker to execute arbitrary system commands, potentially taking full control of the device. The vulnerability is reported as capable of being exploited remotely.

Affected Systems

GL.iNet A1300, AX1800, AXT1800, MT2500, MT3000, MT6000, X3000, and XE3000 running firmware 4.8.x are affected. Firmware 4.9.0 contains a fix that addresses the vulnerability.

Risk and Exploitability

The vulnerability scores a CVSS of 6.9, indicating medium to high severity. No EPSS data is publicly available, and the issue is not listed in the CISA KEV catalog. An attacker can likely trigger the injection through network access to the device, providing a remote exploit path with significant impact if successful.

Generated by OpenCVE AI on August 17, 2026 at 06:21 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Apply firmware 4.9.0 or later to remove the vulnerability.
  • If the NAS Command Service is not needed, disable it or uninstall the related component to eliminate the attack surface.
  • Restrict network access to the device, ensuring only trusted hosts can reach the NAS Command Service, and enforce strong authentication mechanisms.

Generated by OpenCVE AI on August 17, 2026 at 06:21 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Mon, 17 Aug 2026 05:00:00 +0000

Type Values Removed Values Added
Description A vulnerability was detected in GL.iNet A1300, AX1800, AXT1800, MT2500, MT3000, MT6000, X3000 and XE3000 4.8.x. This issue affects some unknown processing of the file /usr/bin/gl_nas_sys of the component NAS Command Service. The manipulation results in os command injection. The attack may be launched remotely. Upgrading to version 4.9.0 is capable of addressing this issue. It is suggested to upgrade the affected component. The vendor explains: "After our investigation, we have confirmed that the vulnerability described (...) does indeed exist."
Title GL.iNet XE3000 NAS Command Service gl_nas_sys os command injection
First Time appeared Gl.inet
Gl.inet a1300
Gl.inet ax1800
Gl.inet axt1800
Gl.inet mt2500
Gl.inet mt3000
Gl.inet mt6000
Gl.inet x3000
Gl.inet xe3000
Weaknesses CWE-77
CWE-78
CPEs cpe:2.3:a:gl.inet:a1300:*:*:*:*:*:*:*:*
cpe:2.3:a:gl.inet:ax1800:*:*:*:*:*:*:*:*
cpe:2.3:a:gl.inet:axt1800:*:*:*:*:*:*:*:*
cpe:2.3:a:gl.inet:mt2500:*:*:*:*:*:*:*:*
cpe:2.3:a:gl.inet:mt3000:*:*:*:*:*:*:*:*
cpe:2.3:a:gl.inet:mt6000:*:*:*:*:*:*:*:*
cpe:2.3:a:gl.inet:x3000:*:*:*:*:*:*:*:*
cpe:2.3:a:gl.inet:xe3000:*:*:*:*:*:*:*:*
Vendors & Products Gl.inet
Gl.inet a1300
Gl.inet ax1800
Gl.inet axt1800
Gl.inet mt2500
Gl.inet mt3000
Gl.inet mt6000
Gl.inet x3000
Gl.inet xe3000
References
Metrics cvssV2_0

{'score': 7.5, 'vector': 'AV:N/AC:L/Au:N/C:P/I:P/A:P/E:ND/RL:OF/RC:C'}

cvssV3_0

{'score': 8.3, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L/E:X/RL:O/RC:C'}

cvssV3_1

{'score': 8.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L/E:X/RL:O/RC:C'}

cvssV4_0

{'score': 6.9, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:L/SI:L/SA:L/E:X'}

Subscriptions

Gl.inet A1300 Ax1800 Axt1800 Mt2500 Mt3000 Mt6000 X3000 Xe3000
cve-icon MITRE

Status: PUBLISHED

Assigner: VulDB

Published:

Updated: 2026-08-17T04:30:11.277Z

Reserved: 2026-08-16T13:38:32.594Z

Link: CVE-2026-19983

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Received

Published: 2026-08-17T05:17:09.947

Modified: 2026-08-17T05:17:09.947

Link: CVE-2026-19983

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-08-17T06:30:04Z

Weaknesses
  • CWE-77

    Improper Neutralization of Special Elements used in a Command ('Command Injection')

  • CWE-78

    Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')