High CVSS 7.4
CVE-2026-19982
A security vulnerability has been detected in GL.iNet BE9300 and MT6000 4.8.x. This vulnerability affects unknown code of the component Firewall-management RPC. The manipulation of the argument dest_port/dest_ip leads to os command injection. The attack may be initiated remotely. Upgrading to version 4.9.0 is able to resolve this issue. The affected component should be upgraded. The vendor explains: "After our investigation, we have confirmed that the vulnerability described (...) does indeed exist."
What this means
- Exposure
- Exploitable remotely over the network, with an ordinary user account and with no action from the victim.
- Impact
- An attacker can read some data, alter some data and degrade the service. The impact spreads beyond the vulnerable component into other parts of the system.
- Weakness
- Unfiltered input is concatenated into a command, letting the attacker append their own.
- Likelihood
- Its EPSS score puts short-term exploitation in a middle band: neither negligible nor imminent.
What to doFold into the next patch cycle.
Read automatically from the CVSS vector, the weakness type (CWE) and the EPSS score. The technical description above remains the one published by NIST.