High severity · published Aug 17, 2026
CVE-2026-19981
GL.iNet XE3000 Wi-Fi Timer Power-Schedule Feature os command injection
7.4
CVSS
1.8%
EPSS
No
On KEV
Description
A weakness has been identified in GL.iNet A1300, AX1800, AXT1800, BE1400, BE3600, BE6500, BE9300, BE10000, E5800, MT2500, MT3000, MT3600BE, MT5000, MT6000, X2000, X3000 and XE3000 up to 4.8.x. This affects an unknown part of the component Wi-Fi Timer Power-Schedule Feature. Executing a manipulation of the argument switch_power/restore_power can lead to os command injection. The attack can be launched remotely. The vendor explains: "After our investigation, we have confirmed that the vulnerability described (...) does indeed exist."
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
Low
Integrity
Low
Availability
Low
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)1.8% · higher than 78% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
A1
A1300 · GL.iNet
4.0; 4.1; 4.2; 4.3; 4.4; 4.5; +3 more · source: vendor
AX
AX1800 · GL.iNet
4.0; 4.1; 4.2; 4.3; 4.4; 4.5; +3 more · source: vendor
AX
AXT1800 · GL.iNet
4.0; 4.1; 4.2; 4.3; 4.4; 4.5; +3 more · source: vendor
BE
BE10000 · GL.iNet
4.0; 4.1; 4.2; 4.3; 4.4; 4.5; +3 more · source: vendor
BE
BE1400 · GL.iNet
4.0; 4.1; 4.2; 4.3; 4.4; 4.5; +3 more · source: vendor
BE
BE3600 · GL.iNet
4.0; 4.1; 4.2; 4.3; 4.4; 4.5; +3 more · source: vendor
BE
BE6500 · GL.iNet
4.0; 4.1; 4.2; 4.3; 4.4; 4.5; +3 more · source: vendor
BE
BE9300 · GL.iNet
4.0; 4.1; 4.2; 4.3; 4.4; 4.5; +3 more · source: vendor
E5
E5800 · GL.iNet
4.0; 4.1; 4.2; 4.3; 4.4; 4.5; +3 more · source: vendor
MT
MT2500 · GL.iNet
4.0; 4.1; 4.2; 4.3; 4.4; 4.5; +3 more · source: vendor
MT
MT3000 · GL.iNet
4.0; 4.1; 4.2; 4.3; 4.4; 4.5; +3 more · source: vendor
MT
MT3600BE · GL.iNet
4.0; 4.1; 4.2; 4.3; 4.4; 4.5; +3 more · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-19981
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-19981
github.com
https://github.com/gl-inet/CVE-issues/blob/main/4.0.0/Wi-Fi%20Timer%20Power-Schedule%20Cron%20RCE.md
vuldb.com
https://vuldb.com/cve/CVE-2026-19981
vuldb.com
https://vuldb.com/submit/873917
vuldb.com
https://vuldb.com/vuln/391163
vuldb.com
https://vuldb.com/vuln/391163/cti
More from A1300
8.3
CVE-2026-19983
GL.iNet XE3000 NAS Command Service gl_nas_sys os command injection
8.3
CVE-2026-19979
GL.iNet XE3000 WebDAV Service MOVE authorization
7.8
CVE-2023-50445
Shell Injection vulnerability GL.iNet A1300 v4.4.6, AX1800 v4.4.6, AXT1800 v4.4.6, MT3000 v4.4.6, MT2500 v4.4.6, MT6000 v4.5.0, MT1300 v4.3.7, MT300N-V2 v4.3.7, AR750S v4.3.7,…
7.5
CVE-2024-27356
An issue was discovered on certain GL-iNet devices
7.4
CVE-2026-19980
GL.iNet XE3000 Language Update ui.update_langs code injection