Login Request a demo
Medium severity · published Jun 8, 2026
CVE-2026-11505
GL.iNet XE3000 glnassys hard-coded key
5.0
CVSS
0.2%
EPSS
No
On KEV
Description
A flaw has been found in GL.iNet A1300, AX1800, AXT1800, MT2500, MT3000, MT6000, X3000 and XE3000 4.8.x. This affects an unknown function of the component glnassys. Executing a manipulation can lead to use of hard-coded cryptographic key . The attack may be launched remotely. The attack requires a high level of complexity. The exploitability is reported as difficult. Upgrading to version 4.9.0 mitigates this issue. Upgrading the affected component is advised.
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L
Attack vector
Network
Complexity
High
Privileges
Low
User interaction
None
Confidentiality
Low
Integrity
Low
Availability
Low
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.2% · higher than 9% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
A1
A1300 · GL.iNet
4.8.* · source: vendor
AX
AX1800 · GL.iNet
4.8.* · source: vendor
AX
AXT1800 · GL.iNet
4.8.* · source: vendor
MT
MT2500 · GL.iNet
4.8.* · source: vendor
MT
MT3000 · GL.iNet
4.8.* · source: vendor
MT
MT6000 · GL.iNet
4.8.* · source: vendor
X3
X3000 · GL.iNet
4.8.* · source: vendor
XE
XE3000 · GL.iNet
4.8.* · source: vendor
Affected product
A1
A1300
GL.iNet
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-11505
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-11505
cloud-static-test.gl-inet.cn
https://cloud-static-test.gl-inet.cn/security/openwrt-ipq60xx-glinet_ax1800-squashfs-sysupgrade.tar
github.com
https://github.com/gl-inet/CVE-issues/blob/main/4.0.0/The%20hard%20coded%20default%20authentication%20token%20in%20gl%20nas%20sys%20poses%20a%20risk%20to%20unauthorized%20command%20execution.md
vuldb.com
https://vuldb.com/cve/CVE-2026-11505
vuldb.com
https://vuldb.com/submit/835698
vuldb.com
https://vuldb.com/vuln/369125
vuldb.com
https://vuldb.com/vuln/369125/cti
More from A1300
8.3
CVE-2026-19983
GL.iNet XE3000 NAS Command Service gl_nas_sys os command injection
8.3
CVE-2026-19979
GL.iNet XE3000 WebDAV Service MOVE authorization
7.8
CVE-2023-50445
Shell Injection vulnerability GL.iNet A1300 v4.4.6, AX1800 v4.4.6, AXT1800 v4.4.6, MT3000 v4.4.6, MT2500 v4.4.6, MT6000 v4.5.0, MT1300 v4.3.7, MT300N-V2 v4.3.7, AR750S v4.3.7,…
7.5
CVE-2024-27356
An issue was discovered on certain GL-iNet devices
7.4
CVE-2026-19981
GL.iNet XE3000 Wi-Fi Timer Power-Schedule Feature os command injection