CVE-2026-19979 PUBLISHED

GL.iNet XE3000 WebDAV Service MOVE authorization

Assigner: VulDB
Reserved: 16.08.2026 Published: 17.08.2026 Updated: 17.08.2026

A vulnerability was identified in GL.iNet A1300, AX1800, AXT1800, BE1400, BE3600, BE6500, BE9300, BE10000, E5800, MT2500, MT3000, MT3600BE, MT5000, MT6000, X2000, X3000 and XE3000 up to 4.8.x. Affected by this vulnerability is the function COPY/MOVE of the component WebDAV Service. Such manipulation leads to authorization bypass. It is possible to launch the attack remotely. The vendor explains: "After our investigation, we have confirmed that the vulnerability described (...) does indeed exist."

Metrics

CVSS Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:L/SI:L/SA:L/E:X
CVSS Score: 6.9

Product Status

Vendor GL.iNet
Product A1300
Versions
  • Version 4.0 is affected
  • Version 4.1 is affected
  • Version 4.2 is affected
  • Version 4.3 is affected
  • Version 4.4 is affected
  • Version 4.5 is affected
  • Version 4.6 is affected
  • Version 4.7 is affected
  • Version 4.8 is affected
Vendor GL.iNet
Product AX1800
Versions
  • Version 4.0 is affected
  • Version 4.1 is affected
  • Version 4.2 is affected
  • Version 4.3 is affected
  • Version 4.4 is affected
  • Version 4.5 is affected
  • Version 4.6 is affected
  • Version 4.7 is affected
  • Version 4.8 is affected
Vendor GL.iNet
Product AXT1800
Versions
  • Version 4.0 is affected
  • Version 4.1 is affected
  • Version 4.2 is affected
  • Version 4.3 is affected
  • Version 4.4 is affected
  • Version 4.5 is affected
  • Version 4.6 is affected
  • Version 4.7 is affected
  • Version 4.8 is affected
Vendor GL.iNet
Product BE1400
Versions
  • Version 4.0 is affected
  • Version 4.1 is affected
  • Version 4.2 is affected
  • Version 4.3 is affected
  • Version 4.4 is affected
  • Version 4.5 is affected
  • Version 4.6 is affected
  • Version 4.7 is affected
  • Version 4.8 is affected
Vendor GL.iNet
Product BE3600
Versions
  • Version 4.0 is affected
  • Version 4.1 is affected
  • Version 4.2 is affected
  • Version 4.3 is affected
  • Version 4.4 is affected
  • Version 4.5 is affected
  • Version 4.6 is affected
  • Version 4.7 is affected
  • Version 4.8 is affected
Vendor GL.iNet
Product BE6500
Versions
  • Version 4.0 is affected
  • Version 4.1 is affected
  • Version 4.2 is affected
  • Version 4.3 is affected
  • Version 4.4 is affected
  • Version 4.5 is affected
  • Version 4.6 is affected
  • Version 4.7 is affected
  • Version 4.8 is affected
Vendor GL.iNet
Product BE9300
Versions
  • Version 4.0 is affected
  • Version 4.1 is affected
  • Version 4.2 is affected
  • Version 4.3 is affected
  • Version 4.4 is affected
  • Version 4.5 is affected
  • Version 4.6 is affected
  • Version 4.7 is affected
  • Version 4.8 is affected
Vendor GL.iNet
Product BE10000
Versions
  • Version 4.0 is affected
  • Version 4.1 is affected
  • Version 4.2 is affected
  • Version 4.3 is affected
  • Version 4.4 is affected
  • Version 4.5 is affected
  • Version 4.6 is affected
  • Version 4.7 is affected
  • Version 4.8 is affected
Vendor GL.iNet
Product E5800
Versions
  • Version 4.0 is affected
  • Version 4.1 is affected
  • Version 4.2 is affected
  • Version 4.3 is affected
  • Version 4.4 is affected
  • Version 4.5 is affected
  • Version 4.6 is affected
  • Version 4.7 is affected
  • Version 4.8 is affected
Vendor GL.iNet
Product MT2500
Versions
  • Version 4.0 is affected
  • Version 4.1 is affected
  • Version 4.2 is affected
  • Version 4.3 is affected
  • Version 4.4 is affected
  • Version 4.5 is affected
  • Version 4.6 is affected
  • Version 4.7 is affected
  • Version 4.8 is affected
Vendor GL.iNet
Product MT3000
Versions
  • Version 4.0 is affected
  • Version 4.1 is affected
  • Version 4.2 is affected
  • Version 4.3 is affected
  • Version 4.4 is affected
  • Version 4.5 is affected
  • Version 4.6 is affected
  • Version 4.7 is affected
  • Version 4.8 is affected
Vendor GL.iNet
Product MT3600BE
Versions
  • Version 4.0 is affected
  • Version 4.1 is affected
  • Version 4.2 is affected
  • Version 4.3 is affected
  • Version 4.4 is affected
  • Version 4.5 is affected
  • Version 4.6 is affected
  • Version 4.7 is affected
  • Version 4.8 is affected
Vendor GL.iNet
Product MT5000
Versions
  • Version 4.0 is affected
  • Version 4.1 is affected
  • Version 4.2 is affected
  • Version 4.3 is affected
  • Version 4.4 is affected
  • Version 4.5 is affected
  • Version 4.6 is affected
  • Version 4.7 is affected
  • Version 4.8 is affected
Vendor GL.iNet
Product MT6000
Versions
  • Version 4.0 is affected
  • Version 4.1 is affected
  • Version 4.2 is affected
  • Version 4.3 is affected
  • Version 4.4 is affected
  • Version 4.5 is affected
  • Version 4.6 is affected
  • Version 4.7 is affected
  • Version 4.8 is affected
Vendor GL.iNet
Product X2000
Versions
  • Version 4.0 is affected
  • Version 4.1 is affected
  • Version 4.2 is affected
  • Version 4.3 is affected
  • Version 4.4 is affected
  • Version 4.5 is affected
  • Version 4.6 is affected
  • Version 4.7 is affected
  • Version 4.8 is affected
Vendor GL.iNet
Product X3000
Versions
  • Version 4.0 is affected
  • Version 4.1 is affected
  • Version 4.2 is affected
  • Version 4.3 is affected
  • Version 4.4 is affected
  • Version 4.5 is affected
  • Version 4.6 is affected
  • Version 4.7 is affected
  • Version 4.8 is affected
Vendor GL.iNet
Product XE3000
Versions
  • Version 4.0 is affected
  • Version 4.1 is affected
  • Version 4.2 is affected
  • Version 4.3 is affected
  • Version 4.4 is affected
  • Version 4.5 is affected
  • Version 4.6 is affected
  • Version 4.7 is affected
  • Version 4.8 is affected

Credits

  • GLiNet (VulDB User) reporter
  • VulDB CNA Team coordinator

References

Problem Types

  • Authorization Bypass CWE
  • Improper Authorization CWE