CVE-2026-19981

GL.iNet XE3000 Wi-Fi Timer Power-Schedule Feature os command injection

Medium5.3EPSS 1.8%

Published: 17 Aug 2026
Updated: 17 Aug 2026
Reserved: 16 Aug 2026
Assigned by: VulDB

Description

A weakness has been identified in GL.iNet A1300, AX1800, AXT1800, BE1400, BE3600, BE6500, BE9300, BE10000, E5800, MT2500, MT3000, MT3600BE, MT5000, MT6000, X2000, X3000 and XE3000 up to 4.8.x. This affects an unknown part of the component Wi-Fi Timer Power-Schedule Feature. Executing a manipulation of the argument switch_power/restore_power can lead to os command injection. The attack can be launched remotely. The vendor explains: "After our investigation, we have confirmed that the vulnerability described (...) does indeed exist."

Scores

CVSS scores of CVE-2026-19981, by who scored it
Scored by	CVSS	Score	Vector
VulDBCNA (assigner)	4.0	Medium5.3	CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:L/SI:L/SA:L/E:X
VulDBCNA (assigner)	3.1	High7.4	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L/E:X/RL:X/RC:R
VulDBCNA (assigner)	3.0	High7.4	CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L/E:X/RL:X/RC:R
VulDBCNA (assigner)	2.0	Medium6.5	AV:N/AC:L/Au:S/C:P/I:P/A:P/E:ND/RL:ND/RC:UR
NVDNVD · Deferred	4.0	Medium5.3	CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:L/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

EPSS (exploitation in 30 days): 1.8% · top 22% of all CVEs (6 Nov 2026)
CISA SSVC: Exploitation: none · Automatable: no · Technical impact: partial

The list uses the assigner's score when there is one, then CISA's, then NVD's: Medium 5.3.

Weakness

Affected products

GL.iNet · A1300
- affected 4.0
- affected 4.1
- affected 4.2
- affected 4.3
- affected 4.4
- affected 4.5
- affected 4.6
- affected 4.7
- affected 4.8
GL.iNet · AX1800
- affected 4.0
- affected 4.1
- affected 4.2
- affected 4.3
- affected 4.4
- affected 4.5
- affected 4.6
- affected 4.7
- affected 4.8
GL.iNet · AXT1800
- affected 4.0
- affected 4.1
- affected 4.2
- affected 4.3
- affected 4.4
- affected 4.5
- affected 4.6
- affected 4.7
- affected 4.8
GL.iNet · BE1400
- affected 4.0
- affected 4.1
- affected 4.2
- affected 4.3
- affected 4.4
- affected 4.5
- affected 4.6
- affected 4.7
- affected 4.8
GL.iNet · BE3600
- affected 4.0
- affected 4.1
- affected 4.2
- affected 4.3
- affected 4.4
- affected 4.5
- affected 4.6
- affected 4.7
- affected 4.8
GL.iNet · BE6500
- affected 4.0
- affected 4.1
- affected 4.2
- affected 4.3
- affected 4.4
- affected 4.5
- affected 4.6
- affected 4.7
- affected 4.8
GL.iNet · BE9300
- affected 4.0
- affected 4.1
- affected 4.2
- affected 4.3
- affected 4.4
- affected 4.5
- affected 4.6
- affected 4.7
- affected 4.8
GL.iNet · BE10000
- affected 4.0
- affected 4.1
- affected 4.2
- affected 4.3
- affected 4.4
- affected 4.5
- affected 4.6
- affected 4.7
- affected 4.8
GL.iNet · E5800
- affected 4.0
- affected 4.1
- affected 4.2
- affected 4.3
- affected 4.4
- affected 4.5
- affected 4.6
- affected 4.7
- affected 4.8
GL.iNet · MT2500
- affected 4.0
- affected 4.1
- affected 4.2
- affected 4.3
- affected 4.4
- affected 4.5
- affected 4.6
- affected 4.7
- affected 4.8
GL.iNet · MT3000
- affected 4.0
- affected 4.1
- affected 4.2
- affected 4.3
- affected 4.4
- affected 4.5
- affected 4.6
- affected 4.7
- affected 4.8
GL.iNet · MT3600BE
- affected 4.0
- affected 4.1
- affected 4.2
- affected 4.3
- affected 4.4
- affected 4.5
- affected 4.6
- affected 4.7
- affected 4.8
GL.iNet · MT5000
- affected 4.0
- affected 4.1
- affected 4.2
- affected 4.3
- affected 4.4
- affected 4.5
- affected 4.6
- affected 4.7
- affected 4.8
GL.iNet · MT6000
- affected 4.0
- affected 4.1
- affected 4.2
- affected 4.3
- affected 4.4
- affected 4.5
- affected 4.6
- affected 4.7
- affected 4.8
GL.iNet · X2000
- affected 4.0
- affected 4.1
- affected 4.2
- affected 4.3
- affected 4.4
- affected 4.5
- affected 4.6
- affected 4.7
- affected 4.8
GL.iNet · X3000
- affected 4.0
- affected 4.1
- affected 4.2
- affected 4.3
- affected 4.4
- affected 4.5
- affected 4.6
- affected 4.7
- affected 4.8
GL.iNet · XE3000
- affected 4.0
- affected 4.1
- affected 4.2
- affected 4.3
- affected 4.4
- affected 4.5
- affected 4.6
- affected 4.7
- affected 4.8

References (5)

VDB-391163 | GL.iNet XE3000 Wi-Fi Timer Power-Schedule Feature os command injection (opens in a new tab)vdb-entrytechnical-description
VDB-391163 | CTI Indicators (IOB, IOC, TTP, IOA) (opens in a new tab)signaturepermissions-required
CVE-2026-19981 | CVE Analysis and Report (opens in a new tab)third-party-advisory
Submit #873917 | GL.iNet Router 4.8.x RCE (opens in a new tab)third-party-advisory
https://github.com/gl-inet/CVE-issues/blob/main/4.0.0/Wi-Fi%20Timer%20Power-Schedule%20Cron%20RCE.md (opens in a new tab)related

Sources

The same CVE in the primary databases and aggregators, to check against.

Badge for a README or a ticket

[![CVE-2026-19981](https://trackcve.app/badge/CVE-2026-19981.svg)](https://trackcve.app/cve/CVE-2026-19981)

Record last updated 17 Aug 2026, 15:47 UTC.