# CVE-2026-19983: GL.iNet multiple routers OS command injection in NAS service

Source: https://junglewise.ai/threats/cve-2026-19983-gl-inet-multiple-routers-os-command-injection-in-nas-service  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-08-17. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-19983 · Severity: high · CVSS 8.3 · Published 2026-08-17

GL.iNet routers provide network storage (NAS) functionality through a service that listens on port 6000. A vulnerability in this service allows remote attackers to bypass authentication and execute arbitrary commands with root privileges without needing valid credentials. This could enable complete device compromise, data theft, or use of the router for further attacks on the network.

Technologies: [GL.iNet A1300](https://junglewise.ai/threats/technologies/a1300), [GL.iNet AX1800](https://junglewise.ai/threats/technologies/ax1800), [GL.iNet AXT1800](https://junglewise.ai/threats/technologies/axt1800), [GL.iNet MT2500](https://junglewise.ai/threats/technologies/mt2500), [GL.iNet MT3000](https://junglewise.ai/threats/technologies/mt3000), [GL.iNet MT6000](https://junglewise.ai/threats/technologies/mt6000), [GL.iNet X3000](https://junglewise.ai/threats/technologies/x3000), [GL.iNet XE3000](https://junglewise.ai/threats/technologies/xe3000). Vendors: [GL.iNet](https://junglewise.ai/threats/vendors/gl-inet).

## Quick answers

**Is CVE-2026-19983 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-19983 being exploited in the wild.

**How severe is CVE-2026-19983?** High severity, with a CVSS score of 8.3, published 17 August 2026.

**Which products and versions are affected?** GL.iNet A1300 4.8.x; GL.iNet AX1800 4.8.x; GL.iNet AXT1800 4.8.x; GL.iNet MT2500 4.8.x; and 4 more.

**Is there a fix for CVE-2026-19983?** A patch was published on 2026: Version 4.9.0 and later address this issue Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-19983 attacked?** It is attacked over the network, in device firmware.

**Am I affected by CVE-2026-19983?** Check whether you run GL.iNet A1300, GL.iNet AX1800, GL.iNet AXT1800 or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability exists in the NAS Command Service (/usr/bin/gl_nas_sys) and involves two chained weaknesses: (1) an authentication bypass in the NAS API token check that can be exploited by sending a Host header of 127.0.0.1, and (2) OS command injection in the GL_NAS_EXEC_FILE API endpoint through shell metacharacters in crafted filenames. The service becomes reachable on port 6000 when an administrator accesses the Network Storage feature in the web portal. No authentication is required; the attack is remotely exploitable from any network-reachable position. Successful exploitation results in unauthenticated remote code execution as root. Firmware version 4.9.0 and later address this issue.

## Affected products

- GL.iNet A1300 4.8.x
- GL.iNet AX1800 4.8.x
- GL.iNet AXT1800 4.8.x
- GL.iNet MT2500 4.8.x
- GL.iNet MT3000 4.8.x
- GL.iNet MT6000 4.8.x
- GL.iNet X3000 4.8.x
- GL.iNet XE3000 4.8.x

## Timeline

- 2026-08-17: disclosed
- 2026: patched: Version 4.9.0 and later address this issue

## References

- [https://github.com/gl-inet/CVE-issues/blob/main/4.0.0/NAS%20Host-header%20bypass%20to%20unauthenticated%20root%20RCE.md](https://github.com/gl-inet/CVE-issues/blob/main/4.0.0/NAS%20Host-header%20bypass%20to%20unauthenticated%20root%20RCE.md)
- [https://vuldb.com/cve/CVE-2026-19983](https://vuldb.com/cve/CVE-2026-19983)

## Related threats

- [GL.iNet BE9300 and MT6000 OS command injection in firewall-management RPC](https://junglewise.ai/threats/cve-2026-19982-gl-inet-be9300-and-mt6000-os-command-injection-in-firewall)
- [GL.iNet Router OS command injection in Wi-Fi Timer Power-Schedule](https://junglewise.ai/threats/cve-2026-19981-gl-inet-router-os-command-injection-in-wi-fi-timer-power-schedule)
- [GL.iNet Router Code Injection in Language Update](https://junglewise.ai/threats/cve-2026-19980-gl-inet-router-code-injection-in-language-update)
- [GL.iNet WebDAV authorization bypass in COPY/MOVE](https://junglewise.ai/threats/cve-2026-19979-gl-inet-webdav-authorization-bypass-in-copy-move)
- [GL.iNet AX1800 command injection in RPC endpoint](https://junglewise.ai/threats/cve-2026-18787-gl-inet-ax1800-command-injection-in-rpc-endpoint)