Record status Published
Identifier year (not publication year) 2026
Source publication Aug 17, 2026
Source updated Aug 17, 2026
Imported by cveboard Oct 24, 2026
CNA source text (English) GL.iNet XE3000 NAS Command Service gl_nas_sys os command injection
A vulnerability was detected in GL.iNet A1300, AX1800, AXT1800, MT2500, MT3000, MT6000, X3000 and XE3000 4.8.x. This issue affects some unknown processing of the file /usr/bin/gl_nas_sys of the component NAS Command Service. The manipulation results in os command injection. The attack may be launched remotely. Upgrading to version 4.9.0 is capable of addressing this issue. It is suggested to upgrade the affected component. The vendor explains: "After our investigation, we have confirmed that the vulnerability described (...) does indeed exist."
Scoped product and version facts Fix information unknown; no fixed version is derived here. Missing information does not prove that no fix exists.
Exploitation unknown; this catalogue does not assess exploitation.
A1300
Vendor GL.iNet
Product A1300
Platforms Unknown
Default status Unknown
A1300 · Scoped product and version facts Version (version) Status (status) Version scheme (versionType) Exclusive end (lessThan) Inclusive end (lessThanOrEqual) Status changes (at → status) 4.8.* affectedUnavailable Unavailable Unavailable None listed 4.9.0 unaffectedUnavailable Unavailable Unavailable None listed
AX1800
Vendor GL.iNet
Product AX1800
Platforms Unknown
Default status Unknown
AX1800 · Scoped product and version facts Version (version) Status (status) Version scheme (versionType) Exclusive end (lessThan) Inclusive end (lessThanOrEqual) Status changes (at → status) 4.8.* affectedUnavailable Unavailable Unavailable None listed 4.9.0 unaffectedUnavailable Unavailable Unavailable None listed
AXT1800
Vendor GL.iNet
Product AXT1800
Platforms Unknown
Default status Unknown
AXT1800 · Scoped product and version facts Version (version) Status (status) Version scheme (versionType) Exclusive end (lessThan) Inclusive end (lessThanOrEqual) Status changes (at → status) 4.8.* affectedUnavailable Unavailable Unavailable None listed 4.9.0 unaffectedUnavailable Unavailable Unavailable None listed
MT2500
Vendor GL.iNet
Product MT2500
Platforms Unknown
Default status Unknown
MT2500 · Scoped product and version facts Version (version) Status (status) Version scheme (versionType) Exclusive end (lessThan) Inclusive end (lessThanOrEqual) Status changes (at → status) 4.8.* affectedUnavailable Unavailable Unavailable None listed 4.9.0 unaffectedUnavailable Unavailable Unavailable None listed
MT3000
Vendor GL.iNet
Product MT3000
Platforms Unknown
Default status Unknown
MT3000 · Scoped product and version facts Version (version) Status (status) Version scheme (versionType) Exclusive end (lessThan) Inclusive end (lessThanOrEqual) Status changes (at → status) 4.8.* affectedUnavailable Unavailable Unavailable None listed 4.9.0 unaffectedUnavailable Unavailable Unavailable None listed
MT6000
Vendor GL.iNet
Product MT6000
Platforms Unknown
Default status Unknown
MT6000 · Scoped product and version facts Version (version) Status (status) Version scheme (versionType) Exclusive end (lessThan) Inclusive end (lessThanOrEqual) Status changes (at → status) 4.8.* affectedUnavailable Unavailable Unavailable None listed 4.9.0 unaffectedUnavailable Unavailable Unavailable None listed
X3000
Vendor GL.iNet
Product X3000
Platforms Unknown
Default status Unknown
X3000 · Scoped product and version facts Version (version) Status (status) Version scheme (versionType) Exclusive end (lessThan) Inclusive end (lessThanOrEqual) Status changes (at → status) 4.8.* affectedUnavailable Unavailable Unavailable None listed 4.9.0 unaffectedUnavailable Unavailable Unavailable None listed
XE3000
Vendor GL.iNet
Product XE3000
Platforms Unknown
Default status Unknown
XE3000 · Scoped product and version facts Version (version) Status (status) Version scheme (versionType) Exclusive end (lessThan) Inclusive end (lessThanOrEqual) Status changes (at → status) 4.8.* affectedUnavailable Unavailable Unavailable None listed 4.9.0 unaffectedUnavailable Unavailable Unavailable None listed