# CVE-2026-19982: GL.iNet BE9300 and MT6000 OS command injection in firewall-management RPC

Source: https://junglewise.ai/threats/cve-2026-19982-gl-inet-be9300-and-mt6000-os-command-injection-in-firewall  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-08-17. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-19982 · Severity: high · CVSS 7.4 · Published 2026-08-17

GL.iNet's BE9300 and MT6000 routers contain a firewall management vulnerability that allows remote attackers to execute arbitrary commands as root. An attacker can inject malicious commands through firewall configuration parameters, potentially gaining full control over the router, reading sensitive files, modifying network settings, and pivoting into connected networks.

Technologies: [GL.iNet MT6000](https://junglewise.ai/threats/technologies/mt6000). Vendors: [GL.iNet](https://junglewise.ai/threats/vendors/gl-inet).

## Quick answers

**Is CVE-2026-19982 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-19982 being exploited in the wild.

**How severe is CVE-2026-19982?** High severity, with a CVSS score of 7.4, published 17 August 2026.

**Which products and versions are affected?** GL.iNet MT6000 4.8.x (fixed in 4.9.0).

**Is there a fix for CVE-2026-19982?** A patch was published on 2026: Fix available in firmware version 4.9.0 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-19982 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2026-19982?** Check whether you run GL.iNet MT6000 at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A command injection vulnerability exists in the firewall-management RPC component of GL.iNet BE9300 and MT6000 routers running firmware version 4.8.x. The vulnerability arises from insufficient input validation on firewall configuration parameters (dest_port and dest_ip), which accept newline characters that are later concatenated unsanitized into conntrack cleanup shell commands. An unauthenticated remote attacker can exploit this by sending crafted RPC requests with embedded shell metacharacters to achieve arbitrary command execution with root privileges. The attack requires network access to the router's management interface and does not require user interaction. A patch is available in firmware version 4.9.0 and later.

## Affected products

- GL.iNet BE9300 4.8.x (fixed in 4.9.0)
- GL.iNet MT6000 4.8.x (fixed in 4.9.0)

## Timeline

- 2026-08-17: disclosed: Public disclosure
- 2026: patched: Fix available in firmware version 4.9.0

## References

- [https://github.com/gl-inet/CVE-issues/blob/main/4.0.0/Firewall%20Cleanup%20RCE.md](https://github.com/gl-inet/CVE-issues/blob/main/4.0.0/Firewall%20Cleanup%20RCE.md)
- [https://vuldb.com/cve/CVE-2026-19982](https://vuldb.com/cve/CVE-2026-19982)

## Related threats

- [GL.iNet multiple routers OS command injection in NAS service](https://junglewise.ai/threats/cve-2026-19983-gl-inet-multiple-routers-os-command-injection-in-nas-service)
- [GL.iNet Router OS command injection in Wi-Fi Timer Power-Schedule](https://junglewise.ai/threats/cve-2026-19981-gl-inet-router-os-command-injection-in-wi-fi-timer-power-schedule)
- [GL.iNet Router Code Injection in Language Update](https://junglewise.ai/threats/cve-2026-19980-gl-inet-router-code-injection-in-language-update)
- [GL.iNet WebDAV authorization bypass in COPY/MOVE](https://junglewise.ai/threats/cve-2026-19979-gl-inet-webdav-authorization-bypass-in-copy-move)
- [GL.iNet Routers hard-coded authentication token in glnassys](https://junglewise.ai/threats/cve-2026-11505-gl-inet-routers-hard-coded-authentication-token-in-glnassys)