CVE-2026-19979

HighCVSS 8.3/10Last modified Aug 20, 2026

Description

A vulnerability was identified in GL.iNet A1300, AX1800, AXT1800, BE1400, BE3600, BE6500, BE9300, BE10000, E5800, MT2500, MT3000, MT3600BE, MT5000, MT6000, X2000, X3000 and XE3000 up to 4.8.x. Affected by this vulnerability is the function COPY/MOVE of the component WebDAV Service. Such manipulation leads to authorization bypass. It is possible to launch the attack remotely. The vendor explains: "After our investigation, we have confirmed that the vulnerability described (...) does indeed exist."

Metrics

CVSS 3.1 8.3/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L

Weakness enumeration

CWE-285 CWE-639

Affected software

Vendor	Product	Versions
GL.iNet	A1300	4.0; 4.1; 4.2; 4.3; 4.4; 4.5; 4.6; 4.7; 4.8
GL.iNet	AX1800	4.0; 4.1; 4.2; 4.3; 4.4; 4.5; 4.6; 4.7; 4.8
GL.iNet	AXT1800	4.0; 4.1; 4.2; 4.3; 4.4; 4.5; 4.6; 4.7; 4.8
GL.iNet	BE1400	4.0; 4.1; 4.2; 4.3; 4.4; 4.5; 4.6; 4.7; 4.8
GL.iNet	BE3600	4.0; 4.1; 4.2; 4.3; 4.4; 4.5; 4.6; 4.7; 4.8
GL.iNet	BE6500	4.0; 4.1; 4.2; 4.3; 4.4; 4.5; 4.6; 4.7; 4.8
GL.iNet	BE9300	4.0; 4.1; 4.2; 4.3; 4.4; 4.5; 4.6; 4.7; 4.8
GL.iNet	BE10000	4.0; 4.1; 4.2; 4.3; 4.4; 4.5; 4.6; 4.7; 4.8
GL.iNet	E5800	4.0; 4.1; 4.2; 4.3; 4.4; 4.5; 4.6; 4.7; 4.8
GL.iNet	MT2500	4.0; 4.1; 4.2; 4.3; 4.4; 4.5; 4.6; 4.7; 4.8
GL.iNet	MT3000	4.0; 4.1; 4.2; 4.3; 4.4; 4.5; 4.6; 4.7; 4.8
GL.iNet	MT3600BE	4.0; 4.1; 4.2; 4.3; 4.4; 4.5; 4.6; 4.7; 4.8
GL.iNet	MT5000	4.0; 4.1; 4.2; 4.3; 4.4; 4.5; 4.6; 4.7; 4.8
GL.iNet	MT6000	4.0; 4.1; 4.2; 4.3; 4.4; 4.5; 4.6; 4.7; 4.8
GL.iNet	X2000	4.0; 4.1; 4.2; 4.3; 4.4; 4.5; 4.6; 4.7; 4.8
GL.iNet	X3000	4.0; 4.1; 4.2; 4.3; 4.4; 4.5; 4.6; 4.7; 4.8
GL.iNet	XE3000	4.0; 4.1; 4.2; 4.3; 4.4; 4.5; 4.6; 4.7; 4.8

References

Timeline

Published: Aug 17, 2026
Last modified: Aug 20, 2026
NVD status: Deferred

Related CVEs from 2026

CVE-2026-19985.5A flaw has been found in micropython up to 1.27.0. This vulnerability affects the function mp_import_all of the file py/runtime.c. This mani CVE-2026-199807.4A security flaw has been discovered in GL.iNet A1300, AX1800, AXT1800, BE1400, BE3600, BE6500, BE9300, BE10000, E5800, MT2500, MT3000, MT360 CVE-2026-199817.4A weakness has been identified in GL.iNet A1300, AX1800, AXT1800, BE1400, BE3600, BE6500, BE9300, BE10000, E5800, MT2500, MT3000, MT3600BE, CVE-2026-199827.4A security vulnerability has been detected in GL.iNet BE9300 and MT6000 4.8.x. This vulnerability affects unknown code of the component Fire CVE-2026-199838.3A vulnerability was detected in GL.iNet A1300, AX1800, AXT1800, MT2500, MT3000, MT6000, X3000 and XE3000 4.8.x. This issue affects some unkn CVE-2026-199846.3A flaw has been found in jkawamoto mcp-florence2 up to 0.3.13. Affected by this issue is the function get_images of the file src/mcp_florenc CVE-2026-199856.1The Relevanssi – A Better Search plugin for WordPress is vulnerable to Reflected Cross-Site Scripting in versions up to, and including, 4.28 CVE-2026-199865.4A weakness has been identified in Adblock for Youtube Extension up to 7.2.1 on Chrome. The impacted element is the function updateDynamicRul CVE-2026-199875.3A security vulnerability has been detected in SourceCodester Best Employee Management System 1.0. This affects an unknown function of the fi CVE-2026-199884.3A vulnerability was detected in Alaev SEO Tools Extension up to 1.0.10 on Chrome. This impacts the function addDiv of the file src/popup.htm CVE-2026-19996.5An incorrect authorization vulnerability was identified in GitHub Enterprise Server that allowed an attacker to merge their own pull request CVE-2026-199918.1The UsersWP plugin for WordPress is vulnerable to Arbitrary File Deletion in versions up to, and including, 1.2.70 via the upload_file_remov