Remote Command Injection in GL.iNet Router Firewall RPC

Researchers have identified a critical security vulnerability (CVE-2026-19982) affecting GL.iNet BE9300 and MT6000 series routers running firmware version 4.8.x. The flaw exists within the Firewall-management Remote Procedure Call (RPC) component. An unauthenticated remote attacker can exploit this by sending specially crafted requests containing malicious input in the 'dest_port' or 'dest_ip' arguments. This manipulation leads to OS command injection, granting the attacker the ability to execute arbitrary code with the privileges of the underlying firmware process. GL.iNet has confirmed the vulnerability and released firmware version 4.9.0 to address the flaw. Defenders should prioritize updating internet-facing devices and restricting management interface access to trusted networks.

Impact

Successful exploitation allows for full system compromise of the affected router, potentially leading to unauthorized network access, data exfiltration, or the establishment of persistent backdoors within the user's network environment. The vulnerability impacts specific high-performance router models commonly deployed in enterprise and small office environments.

Recommendation

• Immediately upgrade all GL.iNet BE9300 and MT6000 devices to firmware version 4.9.0.
• Restrict access to the router management interface (RPC/Web UI) to authorized, internal IP addresses only.
• Monitor firewall logs for anomalous RPC requests containing shell metacharacters (e.g., ;, |, &, $, `) within the 'dest_port' or 'dest_ip' parameter fields.