High severity · published Aug 17, 2026
CVE-2026-19982
GL.iNet BE9300/MT6000 Firewall-management RPC os command injection
7.4
CVSS
1.8%
EPSS
No
On KEV
Description
A security vulnerability has been detected in GL.iNet BE9300 and MT6000 4.8.x. This vulnerability affects unknown code of the component Firewall-management RPC. The manipulation of the argument dest_port/dest_ip leads to os command injection. The attack may be initiated remotely. Upgrading to version 4.9.0 is able to resolve this issue. The affected component should be upgraded. The vendor explains: "After our investigation, we have confirmed that the vulnerability described (...) does indeed exist."
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
Low
Integrity
Low
Availability
Low
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)1.8% · higher than 78% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
BE
BE9300 · GL.iNet
4.8.* · source: vendor
MT
MT6000 · GL.iNet
4.8.* · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-19982
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-19982
github.com
https://github.com/gl-inet/CVE-issues/blob/main/4.0.0/Firewall%20Cleanup%20RCE.md
vuldb.com
https://vuldb.com/cve/CVE-2026-19982
vuldb.com
https://vuldb.com/submit/873918
vuldb.com
https://vuldb.com/vuln/391164
vuldb.com
https://vuldb.com/vuln/391164/cti
More from BE9300
8.3
CVE-2026-19979
GL.iNet XE3000 WebDAV Service MOVE authorization
7.4
CVE-2026-19981
GL.iNet XE3000 Wi-Fi Timer Power-Schedule Feature os command injection
7.4
CVE-2026-19980
GL.iNet XE3000 Language Update ui.update_langs code injection
4.3
CVE-2026-18585
GL.iNet MT2500 APPS-NAS nas-web.get_file_list heap-based overflow