# CVE-2026-19981: GL.iNet Router OS command injection in Wi-Fi Timer Power-Schedule Source: https://junglewise.ai/threats/cve-2026-19981-gl-inet-router-os-command-injection-in-wi-fi-timer-power-schedule Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats Published: 2026-08-17. Updated: 2026-09-25 License: CC BY 4.0 with a link back CVE-2026-19981 · Severity: high · CVSS 7.4 · Published 2026-08-17 GL.iNet routers (sold for small office, home, and enterprise networks) contain a Wi-Fi Timer Power-Schedule feature that fails to validate user input. An attacker can inject arbitrary commands that execute with root privileges, allowing unauthorized access to sensitive configuration, network manipulation, and persistence on the device. Affected models range from budget units (A1300, AX1800) to high-end enterprise routers (BE10000, MT6000). Technologies: [GL.iNet A1300](https://junglewise.ai/threats/technologies/a1300), [GL.iNet AX1800](https://junglewise.ai/threats/technologies/ax1800), [GL.iNet AXT1800](https://junglewise.ai/threats/technologies/axt1800), [GL.iNet BE10000](https://junglewise.ai/threats/technologies/be10000), [GL.iNet BE1400](https://junglewise.ai/threats/technologies/be1400), [GL.iNet BE3600](https://junglewise.ai/threats/technologies/be3600), [GL.iNet E5800](https://junglewise.ai/threats/technologies/e5800), [GL.iNet MT2500](https://junglewise.ai/threats/technologies/mt2500), [GL.iNet MT3000](https://junglewise.ai/threats/technologies/mt3000), [GL.iNet MT3600BE](https://junglewise.ai/threats/technologies/mt3600be), [GL.iNet MT5000](https://junglewise.ai/threats/technologies/mt5000), [GL.iNet MT6000](https://junglewise.ai/threats/technologies/mt6000), [GL.iNet X2000](https://junglewise.ai/threats/technologies/x2000), [GL.iNet X3000](https://junglewise.ai/threats/technologies/x3000), [GL.iNet XE3000](https://junglewise.ai/threats/technologies/xe3000). Vendors: [GL.iNet](https://junglewise.ai/threats/vendors/gl-inet). ## Quick answers **Is CVE-2026-19981 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-19981 being exploited in the wild. **How severe is CVE-2026-19981?** High severity, with a CVSS score of 7.4, published 17 August 2026. **Which products and versions are affected?** GL.iNet A1300 up to 4.8.x; GL.iNet AX1800 up to 4.8.x; GL.iNet AXT1800 up to 4.8.x; GL.iNet BE10000 up to 4.8.x; and 11 more. **Is there a fix for CVE-2026-19981?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it. **How is CVE-2026-19981 attacked?** It is attacked over the network, in device firmware. **Am I affected by CVE-2026-19981?** Check whether you run GL.iNet A1300, GL.iNet AX1800, GL.iNet AXT1800 or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you. ## Technical details The vulnerability is a command injection flaw in the Wi-Fi Timer Power-Schedule component. The affected code accepts user-supplied values for `switch_power` and `restore_power` parameters without proper validation or sanitization. These values are later written into root-level cron job entries, allowing an attacker to inject shell metacharacters and arbitrary commands. The attack requires network access to the router's management interface (typically remote via WAN or LAN) and no authentication bypass is needed if the interface is already exposed. A successful exploit grants arbitrary command execution as root, enabling complete device compromise, persistent backdoor installation, and lateral movement into connected networks. ## Affected products - GL.iNet A1300 up to 4.8.x - GL.iNet AX1800 up to 4.8.x - GL.iNet AXT1800 up to 4.8.x - GL.iNet BE1400 up to 4.8.x - GL.iNet BE3600 up to 4.8.x - GL.iNet BE6500 up to 4.8.x - GL.iNet BE9300 up to 4.8.x - GL.iNet BE10000 up to 4.8.x - GL.iNet E5800 up to 4.8.x - GL.iNet MT2500 up to 4.8.x - GL.iNet MT3000 up to 4.8.x - GL.iNet MT3600BE up to 4.8.x - GL.iNet MT5000 up to 4.8.x - GL.iNet MT6000 up to 4.8.x - GL.iNet X2000 up to 4.8.x - GL.iNet X3000 up to 4.8.x - GL.iNet XE3000 up to 4.8.x ## Timeline - 2026-08-17: disclosed ## References - [https://github.com/gl-inet/CVE-issues/blob/main/4.0.0/Wi-Fi%20Timer%20Power-Schedule%20Cron%20RCE.md](https://github.com/gl-inet/CVE-issues/blob/main/4.0.0/Wi-Fi%20Timer%20Power-Schedule%20Cron%20RCE.md) - [https://vuldb.com/cve/CVE-2026-19981](https://vuldb.com/cve/CVE-2026-19981) ## Related threats - [GL.iNet multiple routers OS command injection in NAS service](https://junglewise.ai/threats/cve-2026-19983-gl-inet-multiple-routers-os-command-injection-in-nas-service) - [GL.iNet BE9300 and MT6000 OS command injection in firewall-management RPC](https://junglewise.ai/threats/cve-2026-19982-gl-inet-be9300-and-mt6000-os-command-injection-in-firewall) - [GL.iNet Router Code Injection in Language Update](https://junglewise.ai/threats/cve-2026-19980-gl-inet-router-code-injection-in-language-update) - [GL.iNet WebDAV authorization bypass in COPY/MOVE](https://junglewise.ai/threats/cve-2026-19979-gl-inet-webdav-authorization-bypass-in-copy-move) - [GL.iNet AX1800 command injection in RPC endpoint](https://junglewise.ai/threats/cve-2026-18787-gl-inet-ax1800-command-injection-in-rpc-endpoint)