# CVE-2026-11505: GL.iNet Routers hard-coded authentication token in glnassys

Source: https://junglewise.ai/threats/cve-2026-11505-gl-inet-routers-hard-coded-authentication-token-in-glnassys  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-06-08. Updated: 2026-06-08  
License: CC BY 4.0 with a link back

CVE-2026-11505 · Severity: medium · CVSS 5 · Published 2026-06-08

A security vulnerability exists in several GL.iNet router models due to the use of a hard-coded authentication token within the network storage component. This flaw allows an attacker to bypass security measures and interact with storage interfaces, potentially leading to unauthorized access to files or the ability to run malicious commands on the device. This could result in the theft of sensitive data stored on the router or a complete compromise of the device's operations.

Technologies: [GL.iNet A1300](https://junglewise.ai/threats/technologies/a1300), [GL.iNet AX1800](https://junglewise.ai/threats/technologies/ax1800), [GL.iNet AXT1800](https://junglewise.ai/threats/technologies/axt1800), [GL.iNet MT2500](https://junglewise.ai/threats/technologies/mt2500), [GL.iNet MT3000](https://junglewise.ai/threats/technologies/mt3000), [GL.iNet MT6000](https://junglewise.ai/threats/technologies/mt6000), [GL.iNet X3000](https://junglewise.ai/threats/technologies/x3000), [GL.iNet XE3000](https://junglewise.ai/threats/technologies/xe3000). Vendors: [GL.iNet](https://junglewise.ai/threats/vendors/gl-inet).

## Quick answers

**Is CVE-2026-11505 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-11505 being exploited in the wild.

**How severe is CVE-2026-11505?** Medium severity, with a CVSS score of 5, published 8 June 2026.

**Which products and versions are affected?** GL.iNet A1300 4.8.x; GL.iNet AX1800 4.8.x; GL.iNet AXT1800 4.8.x; GL.iNet MT2500 4.8.x; and 4 more.

**Is there a fix for CVE-2026-11505?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-11505 attacked?** It is attacked over the network, in device firmware.

**Am I affected by CVE-2026-11505?** Check whether you run GL.iNet A1300, GL.iNet AX1800, GL.iNet AXT1800 or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A vulnerability (CWE-321) exists in the glnassys component of GL.iNet firmware version 4.8.x across multiple router models. The software utilizes a hard-coded default authentication token for network storage interfaces. A remote attacker with low privileges can exploit this by providing the static token to call sensitive storage-related APIs. Successful exploitation can lead to unauthorized access and arbitrary command execution on the underlying operating system. The attack is considered high complexity due to specific environmental or timing requirements. The issue is addressed in firmware version 4.9.0.

## Affected products

- GL.iNet A1300 4.8.x
- GL.iNet AX1800 4.8.x
- GL.iNet AXT1800 4.8.x
- GL.iNet MT2500 4.8.x
- GL.iNet MT3000 4.8.x
- GL.iNet MT6000 4.8.x
- GL.iNet X3000 4.8.x
- GL.iNet XE3000 4.8.x

## Timeline

- 2026-06-08: disclosed
- 2026-06-08: advisory

## References

- [https://cloud-static-test.gl-inet.cn/security/openwrt-ipq60xx-glinet_ax1800-squashfs-sysupgrade.tar](https://cloud-static-test.gl-inet.cn/security/openwrt-ipq60xx-glinet_ax1800-squashfs-sysupgrade.tar)
- [https://github.com/gl-inet/CVE-issues/blob/main/4.0.0/The%20hard%20coded%20default%20authentication%20token%20in%20gl%20nas%20sys%20poses%20a%20risk%20to%20unauthorized%20command%20execution.md](https://github.com/gl-inet/CVE-issues/blob/main/4.0.0/The%20hard%20coded%20default%20authentication%20token%20in%20gl%20nas%20sys%20poses%20a%20risk%20to%20unauthorized%20command%20execution.md)
- [https://vuldb.com/cve/CVE-2026-11505](https://vuldb.com/cve/CVE-2026-11505)
- [https://vuldb.com/submit/835698](https://vuldb.com/submit/835698)
- [https://vuldb.com/vuln/369125](https://vuldb.com/vuln/369125)
- [https://vuldb.com/vuln/369125/cti](https://vuldb.com/vuln/369125/cti)

## Related threats

- [GL.iNet multiple routers OS command injection in NAS service](https://junglewise.ai/threats/cve-2026-19983-gl-inet-multiple-routers-os-command-injection-in-nas-service)
- [GL.iNet BE9300 and MT6000 OS command injection in firewall-management RPC](https://junglewise.ai/threats/cve-2026-19982-gl-inet-be9300-and-mt6000-os-command-injection-in-firewall)
- [GL.iNet Router OS command injection in Wi-Fi Timer Power-Schedule](https://junglewise.ai/threats/cve-2026-19981-gl-inet-router-os-command-injection-in-wi-fi-timer-power-schedule)
- [GL.iNet Router Code Injection in Language Update](https://junglewise.ai/threats/cve-2026-19980-gl-inet-router-code-injection-in-language-update)
- [GL.iNet WebDAV authorization bypass in COPY/MOVE](https://junglewise.ai/threats/cve-2026-19979-gl-inet-webdav-authorization-bypass-in-copy-move)