CVE-2026-19980

GL.iNet XE3000 Language Update ui.update_langs code injection

State: Published
Severity: 5.3 Medium
Published: Aug 17, 2026
Updated: Aug 19, 2026
Reserved: Aug 16, 2026

Description

A security flaw has been discovered in GL.iNet A1300, AX1800, AXT1800, BE1400, BE3600, BE6500, BE9300, BE10000, E5800, MT2500, MT3000, MT3600BE, MT5000, MT6000, X2000, X3000 and XE3000 up to 4.8.x. Affected by this issue is the function ui.update_langs of the component Language Update. Performing a manipulation of the argument hour/min/week results in code injection. The attack can be initiated remotely. The vendor explains: "After our investigation, we have confirmed that the vulnerability described (...) does indeed exist."

Scores

CVSS	Score	Vector	Source
4.0	5.3 Medium	CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:L/SI:L/SA:L/E:X	VulDB
3.1	7.4 High	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L/E:X/RL:X/RC:R	VulDB
3.0	7.4 High	CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L/E:X/RL:X/RC:R	VulDB
2.0	6.5 Medium	AV:N/AC:L/Au:S/C:P/I:P/A:P/E:ND/RL:ND/RC:UR	VulDB

Weaknesses

CWE-94 Code Injection
CWE-74 Injection

Affected Products

Product	Versions
A1300GL.iNet	4.0Affected 4.1Affected 4.2Affected 4.3Affected 4.4Affected 4.5Affected 4.6Affected 4.7Affected 4.8Affected
AX1800GL.iNet	4.0Affected 4.1Affected 4.2Affected 4.3Affected 4.4Affected 4.5Affected 4.6Affected 4.7Affected 4.8Affected
AXT1800GL.iNet	4.0Affected 4.1Affected 4.2Affected 4.3Affected 4.4Affected 4.5Affected 4.6Affected 4.7Affected 4.8Affected
BE1400GL.iNet	4.0Affected 4.1Affected 4.2Affected 4.3Affected 4.4Affected 4.5Affected 4.6Affected 4.7Affected 4.8Affected
BE3600GL.iNet	4.0Affected 4.1Affected 4.2Affected 4.3Affected 4.4Affected 4.5Affected 4.6Affected 4.7Affected 4.8Affected
BE6500GL.iNet	4.0Affected 4.1Affected 4.2Affected 4.3Affected 4.4Affected 4.5Affected 4.6Affected 4.7Affected 4.8Affected
BE9300GL.iNet	4.0Affected 4.1Affected 4.2Affected 4.3Affected 4.4Affected 4.5Affected 4.6Affected 4.7Affected 4.8Affected
BE10000GL.iNet	4.0Affected 4.1Affected 4.2Affected 4.3Affected 4.4Affected 4.5Affected 4.6Affected 4.7Affected 4.8Affected
E5800GL.iNet	4.0Affected 4.1Affected 4.2Affected 4.3Affected 4.4Affected 4.5Affected 4.6Affected 4.7Affected 4.8Affected
MT2500GL.iNet	4.0Affected 4.1Affected 4.2Affected 4.3Affected 4.4Affected 4.5Affected 4.6Affected 4.7Affected 4.8Affected
MT3000GL.iNet	4.0Affected 4.1Affected 4.2Affected 4.3Affected 4.4Affected 4.5Affected 4.6Affected 4.7Affected 4.8Affected
MT3600BEGL.iNet	4.0Affected 4.1Affected 4.2Affected 4.3Affected 4.4Affected 4.5Affected 4.6Affected 4.7Affected 4.8Affected
MT5000GL.iNet	4.0Affected 4.1Affected 4.2Affected 4.3Affected 4.4Affected 4.5Affected 4.6Affected 4.7Affected 4.8Affected
MT6000GL.iNet	4.0Affected 4.1Affected 4.2Affected 4.3Affected 4.4Affected 4.5Affected 4.6Affected 4.7Affected 4.8Affected
X2000GL.iNet	4.0Affected 4.1Affected 4.2Affected 4.3Affected 4.4Affected 4.5Affected 4.6Affected 4.7Affected 4.8Affected
X3000GL.iNet	4.0Affected 4.1Affected 4.2Affected 4.3Affected 4.4Affected 4.5Affected 4.6Affected 4.7Affected 4.8Affected
XE3000GL.iNet	4.0Affected 4.1Affected 4.2Affected 4.3Affected 4.4Affected 4.5Affected 4.6Affected 4.7Affected 4.8Affected

References

VDB-391162 | GL.iNet XE3000 Language Update ui.update_langs code injectionvdb-entrytechnical-description
VDB-391162 | CTI Indicators (IOB, IOC, TTP, IOA)signaturepermissions-required
CVE-2026-19980 | CVE Analysis and Reportthird-party-advisory
Submit #873916 | GL.iNet Router 4.8.x RCEthird-party-advisory
https://github.com/gl-inet/CVE-issues/blob/main/4.0.0/Language%20Auto-Update%20Cron%20RCE.mdpatch

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.