GL.iNet-Multiple-Vulnerabilities

GL.iNet Multiple Vulnerabilities This repository contains the exploits of the following vulnerabilities: CVE-2023-46454: In GL.iNET GL-AR300M routers with firmware v4.3.7, it is possible to inject arbitrary shell commands through a crafted package name in the package information functionality...

GL.iNet <= 4.3.7 - Arbitrary File Write

GL.iNet = 4.3.7 is vulnerable to an arbitrary file write exploit, allowing an attacker to overwrite arbitrary system files. id: CVE-2023-46455 info: name: GL.iNet = 4.3.7 - Arbitrary File Write author: Zierax severity: high description: | GL.iNet = 4.3.7 is vulnerable to an arbitrary file write...

glinet-beryl-ax-triple-rce-cve-2026-11450-11451-11452-unauthenticated-root-on-travel-router

GL.iNet Beryl AX Triple RCE PoC PoC for three unauthenticated command injection vulnerabilities CVE-2026-11450, CVE-2026-11451, CVE-2026-11452 in the GL.iNet GL-MT3000 Beryl AX travel router firmware = 4.4.5. Full writeup:...

MangoPunch-CVE-2022-31898

🥭 MangoPunch: CVE-2022-31898 Authenticated OS Command Injection for GL.iNet Devices | / | | \ | | | \ / | | | | | | | |/| |/ | ' \ / |/ | / | | | ' \ / | ' \ | | | | | | | | | | | | | | || | | | | | | | | || ||,|| ||, |/|| ,|| |||| || / | |/ 🔍 Vulnerability Overview This repository contains...

CVE-2023-47464

GL-AX1800 Router Security Assessment Report Overview This report outlines the findings of a comprehensive security assessment conducted on the GL-AX1800 router manufactured by GL.iNet. The assessment aimed to identify potential vulnerabilities and weaknesses in the device's security measures...

GL.iNet-4.x-Init-PoC

GL.iNet-4.x-Init-PoC Security research PoC for ana...

CVE-2026-19982

A security vulnerability has been detected in GL.iNet BE9300 and MT6000 4.8.x. This vulnerability affects unknown code of the component Firewall-management RPC. The manipulation of the argument destport/destip leads to os command injection. The attack may be initiated remotely. Upgrading to versi...

CVE-2026-19983

A vulnerability was detected in GL.iNet A1300, AX1800, AXT1800, MT2500, MT3000, MT6000, X3000 and XE3000 4.8.x. This issue affects some unknown processing of the file /usr/bin/glnassys of the component NAS Command Service. The manipulation results in os command injection. The attack may be launch...

EUVD-2026-60046

A vulnerability was detected in GL.iNet A1300, AX1800, AXT1800, MT2500, MT3000, MT6000, X3000 and XE3000 4.8.x. This issue affects some unknown processing of the file /usr/bin/glnassys of the component NAS Command Service. The manipulation results in os command injection. The attack may be launch...

CVE-2026-19983

A vulnerability was detected in GL.iNet A1300, AX1800, AXT1800, MT2500, MT3000, MT6000, X3000 and XE3000 4.8.x. This issue affects some unknown processing of the file /usr/bin/glnassys of the component NAS Command Service. The manipulation results in os command injection. The attack may be launch...

CVE-2026-19983 GL.iNet XE3000 NAS Command Service gl_nas_sys os command injection

A vulnerability was detected in GL.iNet A1300, AX1800, AXT1800, MT2500, MT3000, MT6000, X3000 and XE3000 4.8.x. This issue affects some unknown processing of the file /usr/bin/glnassys of the component NAS Command Service. The manipulation results in os command injection. The attack may be launch...

CVE-2026-19983

GL.iNet devices (A1300, AX1800, AXT1800, MT2500, MT3000, MT6000, X3000, XE3000) running 4.8.x are affected by a vulnerability in NAS Command Service due to improper processing of /usr/bin/gl_nas_sys, enabling remote OS command injection. The issue allows a remote attacker to execute arbitrary com...

CVE-2026-19981

A weakness has been identified in GL.iNet A1300, AX1800, AXT1800, BE1400, BE3600, BE6500, BE9300, BE10000, E5800, MT2500, MT3000, MT3600BE, MT5000, MT6000, X2000, X3000 and XE3000 up to 4.8.x. This affects an unknown part of the component Wi-Fi Timer Power-Schedule Feature. Executing a manipulati...

CVE-2026-19980

A security flaw has been discovered in GL.iNet A1300, AX1800, AXT1800, BE1400, BE3600, BE6500, BE9300, BE10000, E5800, MT2500, MT3000, MT3600BE, MT5000, MT6000, X2000, X3000 and XE3000 up to 4.8.x. Affected by this issue is the function ui.updatelangs of the component Language Update. Performing ...

CVE-2026-19979

A vulnerability was identified in GL.iNet A1300, AX1800, AXT1800, BE1400, BE3600, BE6500, BE9300, BE10000, E5800, MT2500, MT3000, MT3600BE, MT5000, MT6000, X2000, X3000 and XE3000 up to 4.8.x. Affected by this vulnerability is the function COPY/MOVE of the component WebDAV Service. Such...

CVE-2026-19982

A security vulnerability has been detected in GL.iNet BE9300 and MT6000 4.8.x. This vulnerability affects unknown code of the component Firewall-management RPC. The manipulation of the argument destport/destip leads to os command injection. The attack may be initiated remotely. Upgrading to versi...

EUVD-2026-60042

A security vulnerability has been detected in GL.iNet BE9300 and MT6000 4.8.x. This vulnerability affects unknown code of the component Firewall-management RPC. The manipulation of the argument destport/destip leads to os command injection. The attack may be initiated remotely. Upgrading to versi...

CVE-2026-19982 GL.iNet BE9300/MT6000 Firewall-management RPC os command injection

A security vulnerability has been detected in GL.iNet BE9300 and MT6000 4.8.x. This vulnerability affects unknown code of the component Firewall-management RPC. The manipulation of the argument destport/destip leads to os command injection. The attack may be initiated remotely. Upgrading to versi...

CVE-2026-19982

CVE-2026-19982 affects GL.iNet BE9300 and MT6000 devices running 4.8.x, in the firewall-management RPC component. The issue arises from input manipulation of dest_port/dest_ip, leading to an OS command injection. A remote attacker could trigger this without user interaction. Upgrading to version ...

CVE-2026-19982 GL.iNet BE9300/MT6000 Firewall-management RPC os command injection

A security vulnerability has been detected in GL.iNet BE9300 and MT6000 4.8.x. This vulnerability affects unknown code of the component Firewall-management RPC. The manipulation of the argument destport/destip leads to os command injection. The attack may be initiated remotely. Upgrading to versi...