Is CVE-2026-19982 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-19982 being exploited in the wild.

How severe is CVE-2026-19982?

High severity, with a CVSS score of 7.4, published 17 August 2026.

Which products and versions are affected?

GL.iNet MT6000 4.8.x (fixed in 4.9.0).

Is there a fix for CVE-2026-19982?

A patch was published on 2026: Fix available in firmware version 4.9.0 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-19982 attacked?

It is attacked over the network, in a network appliance.

Am I affected by CVE-2026-19982?

Check whether you run GL.iNet MT6000 at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-19982: GL.iNet BE9300 and MT6000 OS command injection in firewall-management RPC

CVE-2026-19982 · Severity: high · CVSS 7.4 · Published 2026-08-17

GL.iNet's BE9300 and MT6000 routers contain a firewall management vulnerability that allows remote attackers to execute arbitrary commands as root. An attacker can inject malicious commands through firewall configuration parameters, potentially gaining full control over the router, reading sensitive files, modifying network settings, and pivoting into connected networks.

Technologies: GL.iNet MT6000. Vendors: GL.iNet.

Quick answers

Is CVE-2026-19982 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-19982 being exploited in the wild.
How severe is CVE-2026-19982?: High severity, with a CVSS score of 7.4, published 17 August 2026.
Which products and versions are affected?: GL.iNet MT6000 4.8.x (fixed in 4.9.0).
Is there a fix for CVE-2026-19982?: A patch was published on 2026: Fix available in firmware version 4.9.0 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-19982 attacked?: It is attacked over the network, in a network appliance.
Am I affected by CVE-2026-19982?: Check whether you run GL.iNet MT6000 at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A command injection vulnerability exists in the firewall-management RPC component of GL.iNet BE9300 and MT6000 routers running firmware version 4.8.x. The vulnerability arises from insufficient input validation on firewall configuration parameters (dest_port and dest_ip), which accept newline characters that are later concatenated unsanitized into conntrack cleanup shell commands. An unauthenticated remote attacker can exploit this by sending crafted RPC requests with embedded shell metacharacters to achieve arbitrary command execution with root privileges. The attack requires network access to the router's management interface and does not require user interaction. A patch is available in firmware version 4.9.0 and later.

Affected products

GL.iNet BE9300 4.8.x (fixed in 4.9.0)
GL.iNet MT6000 4.8.x (fixed in 4.9.0)

Timeline

2026-08-17: disclosed: Public disclosure
2026: patched: Fix available in firmware version 4.9.0

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.