Description

A security flaw has been discovered in GL.iNet A1300, AX1800, AXT1800, BE1400, BE3600, BE6500, BE9300, BE10000, E5800, MT2500, MT3000, MT3600BE, MT5000, MT6000, X2000, X3000 and XE3000 up to 4.8.x. Affected by this issue is the function ui.update_langs of the component Language Update. Performing a manipulation of the argument hour/min/week results in code injection. The attack can be initiated remotely. The vendor explains: "After our investigation, we have confirmed that the vulnerability described (...) does indeed exist."

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.4",
  "pubDate": "2026-08-17T04:16:56.250Z",
  "pubdate": "2026-08-17T04:16:56.250Z",
  "executiveSummary": "A critical code injection vulnerability has been identified in multiple GL.iNet router models, including A1300, AX1800, AXT1800, BE1400, BE3600, BE6500, BE9300, BE10000, E5800, MT2500, MT3000, MT3600BE, MT5000, MT6000, X2000, X3000, and XE3000 running firmware versions up to 4.8.x.\nThe vulnerability resides within the Language Update component, specifically in the ui.update_langs function.\nBy manipulating specific parameters such as hour, min, or week, an unauthenticated remote attacker can inject and execute arbitrary code on the underlying operating system.\nSuccessful exploitation of this flaw allows remote code execution with elevated privileges, severely compromising the confidentiality, integrity, and availability of the affected network devices.\nThe vendor has confirmed the existence of this vulnerability following internal investigations, highlighting significant risk exposure for deployed hardware operating vulnerable firmware versions.",
  "technicalDetails": "The security flaw is categorized as a code injection vulnerability affecting the Language Update component of the GL.iNet firmware ecosystem.\nThe vulnerable code path is localized within the ui.update_langs function, which processes input parameters related to scheduling or configuration, specifically the hour, min, and week arguments.\nThe root cause stems from insufficient input validation and sanitization of these parameters before they are passed to underlying system execution sinks or interpreted by the application logic.\nAn attacker can initiate exploitation remotely by crafting malicious HTTP requests targeting the web administrative interface or API endpoints that invoke the ui.update_langs function.\nDuring the attack flow, the attacker supplies specially crafted payloads containing shell commands or executable code via the vulnerable hour, min, or week arguments.\nBecause the application fails to properly neutralize meta-characters or validate the syntactic structure of the input, the injected payload is concatenated or evaluated directly by the system shell or interpreter.\nThis triggers arbitrary code execution on the device under the security context of the web daemon or root user, depending on the service configuration.\nNetwork exposure is high as the attack can be initiated remotely, assuming access to the management interface is reachable via the local network or exposed to the wide area network.\nAuthentication and privilege requirements depend on the exposure of the administrative interface, but successful exploitation yields complete device compromise, enabling persistent access, traffic interception, or lateral movement into connected internal networks."
}