{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/products/mt6000-4.8.x/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":[],"_cs_cves":[{"cvss":7.4,"id":"CVE-2026-19982"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["BE9300 (4.8.x)","MT6000 (4.8.x)"],"_cs_severities":["high"],"_cs_tags":["remote-code-execution","firewall","networking","cve"],"_cs_type":"advisory","_cs_vendors":["GL.iNet"],"content_html":"\u003cp\u003eResearchers have identified a critical security vulnerability (CVE-2026-19982) affecting GL.iNet BE9300 and MT6000 series routers running firmware version 4.8.x. The flaw exists within the Firewall-management Remote Procedure Call (RPC) component. An unauthenticated remote attacker can exploit this by sending specially crafted requests containing malicious input in the 'dest_port' or 'dest_ip' arguments. This manipulation leads to OS command injection, granting the attacker the ability to execute arbitrary code with the privileges of the underlying firmware process. GL.iNet has confirmed the vulnerability and released firmware version 4.9.0 to address the flaw. Defenders should prioritize updating internet-facing devices and restricting management interface access to trusted networks.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation allows for full system compromise of the affected router, potentially leading to unauthorized network access, data exfiltration, or the establishment of persistent backdoors within the user's network environment. The vulnerability impacts specific high-performance router models commonly deployed in enterprise and small office environments.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eImmediately upgrade all GL.iNet BE9300 and MT6000 devices to firmware version 4.9.0.\u003c/li\u003e\n\u003cli\u003eRestrict access to the router management interface (RPC/Web UI) to authorized, internal IP addresses only.\u003c/li\u003e\n\u003cli\u003eMonitor firewall logs for anomalous RPC requests containing shell metacharacters (e.g., ;, |, \u0026amp;, $, `) within the 'dest_port' or 'dest_ip' parameter fields.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-08-17T08:44:41Z","date_published":"2026-08-17T08:44:41Z","id":"https://feed.craftedsignal.io/briefs/2026-08-glinet-rce/","summary":"An OS command injection vulnerability in the Firewall-management RPC component of GL.iNet BE9300 and MT6000 routers allows remote, unauthenticated attackers to execute arbitrary system commands via crafted network parameters.","title":"Remote Command Injection in GL.iNet Router Firewall RPC","url":"https://feed.craftedsignal.io/briefs/2026-08-glinet-rce/"}],"language":"en","title":"CraftedSignal Threat Feed - MT6000 (4.8.x)","version":"https://jsonfeed.org/version/1.1"}