CVE-2026-11505

GL.iNet XE3000 glnassys hard-coded key

State: Published
Severity: 2.3 Low
Published: Jun 8, 2026
Updated: Jun 8, 2026
Reserved: Jun 7, 2026

Description

A flaw has been found in GL.iNet A1300, AX1800, AXT1800, MT2500, MT3000, MT6000, X3000 and XE3000 4.8.x. This affects an unknown function of the component glnassys. Executing a manipulation can lead to use of hard-coded cryptographic key . The attack may be launched remotely. The attack requires a high level of complexity. The exploitability is reported as difficult. Upgrading to version 4.9.0 mitigates this issue. Upgrading the affected component is advised.

Scores

CVSS	Score	Vector	Source
4.0	2.3 Low	CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X	VulDB
3.1	5.0 Medium	CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L/E:X/RL:O/RC:C	VulDB
3.0	5.0 Medium	CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L/E:X/RL:O/RC:C	VulDB
2.0	4.6 Medium	AV:N/AC:H/Au:S/C:P/I:P/A:P/E:ND/RL:OF/RC:C	VulDB

Weaknesses

CWE-321 Use of Hard-coded Cryptographic Key
CWE-320 Key Management Error

Affected Products

Product	Versions
A1300GL.iNet	4.8.*Affected 4.9.0Not affected
AX1800GL.iNet	4.8.*Affected 4.9.0Not affected
AXT1800GL.iNet	4.8.*Affected 4.9.0Not affected
MT2500GL.iNet	4.8.*Affected 4.9.0Not affected
MT3000GL.iNet	4.8.*Affected 4.9.0Not affected
MT6000GL.iNet	4.8.*Affected 4.9.0Not affected
X3000GL.iNet	4.8.*Affected 4.9.0Not affected
XE3000GL.iNet	4.8.*Affected 4.9.0Not affected

References

VDB-369125 | GL.iNet XE3000 glnassys hard-coded keyvdb-entry
VDB-369125 | CTI Indicators (IOB, IOC, TTP)signaturepermissions-required
CVE-2026-11505 | CVE Analysis and Reportthird-party-advisory
Submit #835698 | GL.iNet Router 4.8.x unauthorizedthird-party-advisory
https://github.com/gl-inet/CVE-issues/blob/main/4.0.0/The%20hard%20coded%20default%20authentication%20token%20in%20gl%20nas%20sys%20poses%20a%20risk%20to%20unauthorized%20command%20execution.mdrelated
https://cloud-static-test.gl-inet.cn/security/openwrt-ipq60xx-glinet_ax1800-squashfs-sysupgrade.tarpatch

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.