Description

A vulnerability was detected in GL.iNet A1300, AX1800, AXT1800, MT2500, MT3000, MT6000, X3000 and XE3000 4.8.x. This issue affects some unknown processing of the file /usr/bin/gl_nas_sys of the component NAS Command Service. The manipulation results in os command injection. The attack may be launched remotely. Upgrading to version 4.9.0 is capable of addressing this issue. It is suggested to upgrade the affected component. The vendor explains: "After our investigation, we have confirmed that the vulnerability described (...) does indeed exist."

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.3",
  "pubDate": "2026-08-17T05:17:09.947Z",
  "pubdate": "2026-08-17T05:17:09.947Z",
  "executiveSummary": "A critical OS command injection vulnerability has been identified within the NAS Command Service component of multiple GL.iNet router models running firmware version 4.8.x. Specifically, the flaw resides in the processing logic of the binary file /usr/bin/gl_nas_sys. An unauthenticated or remotely positioned threat actor capable of interacting with the affected service can manipulate input parameters to inject arbitrary operating system commands, resulting in remote code execution with the privileges of the underlying service process. The security implication is severe, as successful exploitation could lead to full system compromise, unauthorized data access, and persistent device manipulation within the local or wide-area network. The vendor has officially confirmed the existence of this vulnerability and issued firmware version 4.9.0 to remediate the flaw. Immediate patching is strongly advised for all deployed units utilizing the vulnerable firmware branch.",
  "technicalDetails": "The vulnerability is classified as an OS command injection flaw stemming from unsafe handling of external input within the NAS Command Service component of the GL.iNet firmware. The specific attack surface is exposed via the executable binary /usr/bin/gl_nas_sys, which fails to properly sanitize, validate, or escape parameters supplied to system-level execution routines. When malicious input is passed into the processing pipeline of /usr/bin/gl_nas_sys, the application improperly concatenates or passes these values directly to underlying shell interpretation functions, allowing arbitrary command sequences to be appended and executed by the operating system.\nThe attack flow begins with the threat actor identifying network exposure to the vulnerable NAS Command Service. Because the service processes requests remotely, an attacker can craft a specialized payload containing shell metacharacters and injected commands. Upon transmission, the /usr/bin/gl_nas_sys binary processes the malicious request without adequate input validation. The injection payload breaks out of the intended functional argument context and allows the execution of arbitrary system binaries or scripts.\nThe affected product line includes GL.iNet A1300, AX1800, AXT1800, MT2500, MT3000, MT6000, X3000, and XE3000 running firmware version 4.8.x. Depending on the exact network configuration and service exposure, exploitation can be initiated remotely. Successful execution yields code execution within the security context of the NAS Command Service process, typically leading to root-level privileges on embedded router architectures. Post-exploitation impact includes unauthorized modification of device configurations, interception of network traffic, installation of backdoors, and lateral movement into connected internal networks."
}