CVE-2026-19980 PUBLISHED

GL.iNet XE3000 Language Update ui.update_langs code injection

Assigner: VulDB
Reserved: 16.08.2026 Published: 17.08.2026 Updated: 17.08.2026

A security flaw has been discovered in GL.iNet A1300, AX1800, AXT1800, BE1400, BE3600, BE6500, BE9300, BE10000, E5800, MT2500, MT3000, MT3600BE, MT5000, MT6000, X2000, X3000 and XE3000 up to 4.8.x. Affected by this issue is the function ui.update_langs of the component Language Update. Performing a manipulation of the argument hour/min/week results in code injection. The attack can be initiated remotely. The vendor explains: "After our investigation, we have confirmed that the vulnerability described (...) does indeed exist."

Metrics

CVSS Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:L/SI:L/SA:L/E:X
CVSS Score: 5.3

Product Status

Vendor GL.iNet
Product A1300
Versions
  • Version 4.0 is affected
  • Version 4.1 is affected
  • Version 4.2 is affected
  • Version 4.3 is affected
  • Version 4.4 is affected
  • Version 4.5 is affected
  • Version 4.6 is affected
  • Version 4.7 is affected
  • Version 4.8 is affected
Vendor GL.iNet
Product AX1800
Versions
  • Version 4.0 is affected
  • Version 4.1 is affected
  • Version 4.2 is affected
  • Version 4.3 is affected
  • Version 4.4 is affected
  • Version 4.5 is affected
  • Version 4.6 is affected
  • Version 4.7 is affected
  • Version 4.8 is affected
Vendor GL.iNet
Product AXT1800
Versions
  • Version 4.0 is affected
  • Version 4.1 is affected
  • Version 4.2 is affected
  • Version 4.3 is affected
  • Version 4.4 is affected
  • Version 4.5 is affected
  • Version 4.6 is affected
  • Version 4.7 is affected
  • Version 4.8 is affected
Vendor GL.iNet
Product BE1400
Versions
  • Version 4.0 is affected
  • Version 4.1 is affected
  • Version 4.2 is affected
  • Version 4.3 is affected
  • Version 4.4 is affected
  • Version 4.5 is affected
  • Version 4.6 is affected
  • Version 4.7 is affected
  • Version 4.8 is affected
Vendor GL.iNet
Product BE3600
Versions
  • Version 4.0 is affected
  • Version 4.1 is affected
  • Version 4.2 is affected
  • Version 4.3 is affected
  • Version 4.4 is affected
  • Version 4.5 is affected
  • Version 4.6 is affected
  • Version 4.7 is affected
  • Version 4.8 is affected
Vendor GL.iNet
Product BE6500
Versions
  • Version 4.0 is affected
  • Version 4.1 is affected
  • Version 4.2 is affected
  • Version 4.3 is affected
  • Version 4.4 is affected
  • Version 4.5 is affected
  • Version 4.6 is affected
  • Version 4.7 is affected
  • Version 4.8 is affected
Vendor GL.iNet
Product BE9300
Versions
  • Version 4.0 is affected
  • Version 4.1 is affected
  • Version 4.2 is affected
  • Version 4.3 is affected
  • Version 4.4 is affected
  • Version 4.5 is affected
  • Version 4.6 is affected
  • Version 4.7 is affected
  • Version 4.8 is affected
Vendor GL.iNet
Product BE10000
Versions
  • Version 4.0 is affected
  • Version 4.1 is affected
  • Version 4.2 is affected
  • Version 4.3 is affected
  • Version 4.4 is affected
  • Version 4.5 is affected
  • Version 4.6 is affected
  • Version 4.7 is affected
  • Version 4.8 is affected
Vendor GL.iNet
Product E5800
Versions
  • Version 4.0 is affected
  • Version 4.1 is affected
  • Version 4.2 is affected
  • Version 4.3 is affected
  • Version 4.4 is affected
  • Version 4.5 is affected
  • Version 4.6 is affected
  • Version 4.7 is affected
  • Version 4.8 is affected
Vendor GL.iNet
Product MT2500
Versions
  • Version 4.0 is affected
  • Version 4.1 is affected
  • Version 4.2 is affected
  • Version 4.3 is affected
  • Version 4.4 is affected
  • Version 4.5 is affected
  • Version 4.6 is affected
  • Version 4.7 is affected
  • Version 4.8 is affected
Vendor GL.iNet
Product MT3000
Versions
  • Version 4.0 is affected
  • Version 4.1 is affected
  • Version 4.2 is affected
  • Version 4.3 is affected
  • Version 4.4 is affected
  • Version 4.5 is affected
  • Version 4.6 is affected
  • Version 4.7 is affected
  • Version 4.8 is affected
Vendor GL.iNet
Product MT3600BE
Versions
  • Version 4.0 is affected
  • Version 4.1 is affected
  • Version 4.2 is affected
  • Version 4.3 is affected
  • Version 4.4 is affected
  • Version 4.5 is affected
  • Version 4.6 is affected
  • Version 4.7 is affected
  • Version 4.8 is affected
Vendor GL.iNet
Product MT5000
Versions
  • Version 4.0 is affected
  • Version 4.1 is affected
  • Version 4.2 is affected
  • Version 4.3 is affected
  • Version 4.4 is affected
  • Version 4.5 is affected
  • Version 4.6 is affected
  • Version 4.7 is affected
  • Version 4.8 is affected
Vendor GL.iNet
Product MT6000
Versions
  • Version 4.0 is affected
  • Version 4.1 is affected
  • Version 4.2 is affected
  • Version 4.3 is affected
  • Version 4.4 is affected
  • Version 4.5 is affected
  • Version 4.6 is affected
  • Version 4.7 is affected
  • Version 4.8 is affected
Vendor GL.iNet
Product X2000
Versions
  • Version 4.0 is affected
  • Version 4.1 is affected
  • Version 4.2 is affected
  • Version 4.3 is affected
  • Version 4.4 is affected
  • Version 4.5 is affected
  • Version 4.6 is affected
  • Version 4.7 is affected
  • Version 4.8 is affected
Vendor GL.iNet
Product X3000
Versions
  • Version 4.0 is affected
  • Version 4.1 is affected
  • Version 4.2 is affected
  • Version 4.3 is affected
  • Version 4.4 is affected
  • Version 4.5 is affected
  • Version 4.6 is affected
  • Version 4.7 is affected
  • Version 4.8 is affected
Vendor GL.iNet
Product XE3000
Versions
  • Version 4.0 is affected
  • Version 4.1 is affected
  • Version 4.2 is affected
  • Version 4.3 is affected
  • Version 4.4 is affected
  • Version 4.5 is affected
  • Version 4.6 is affected
  • Version 4.7 is affected
  • Version 4.8 is affected

Credits

  • GLiNet (VulDB User) reporter
  • VulDB CNA Team coordinator

References

Problem Types

  • Code Injection CWE
  • Injection CWE