Skip to content

Product

gl.inet mt3000 vulnerabilities

8 published CVES affecting gl.inet mt3000, from public sources (CVE.org, NVD, CISA KEV, FIRST EPSS, OSV).

Total
8
Critical
0
High
1
Medium
6
Low
1
Unscored
0
CISA KEV
0

Latest gl.inet mt3000 CVEs

Newest publication first

  1. CVE-2026-19983 GL.iNet XE3000 NAS Command Service gl_nas_sys os command injection

    Published
    MediumCVSS 6.9 EPSS 2.1%

    A vulnerability was detected in GL.iNet A1300, AX1800, AXT1800, MT2500, MT3000, MT6000, X3000 and XE3000 4.8.x. This issue affects some unknown processing of the file /usr/bin/gl_nas_sys of the component NAS Command Service. The manipulation results in os command injection. The a...

  3. CVE-2026-19980 GL.iNet XE3000 Language Update ui.update_langs code injection

    Published
    MediumCVSS 5.3 EPSS 0.39%

    A security flaw has been discovered in GL.iNet A1300, AX1800, AXT1800, BE1400, BE3600, BE6500, BE9300, BE10000, E5800, MT2500, MT3000, MT3600BE, MT5000, MT6000, X2000, X3000 and XE3000 up to 4.8.x. Affected by this issue is the function ui.update_langs of the component Language U...

  4. CVE-2026-19979 GL.iNet XE3000 WebDAV Service MOVE authorization

    Published
    MediumCVSS 6.9 EPSS 0.54%

    A vulnerability was identified in GL.iNet A1300, AX1800, AXT1800, BE1400, BE3600, BE6500, BE9300, BE10000, E5800, MT2500, MT3000, MT3600BE, MT5000, MT6000, X2000, X3000 and XE3000 up to 4.8.x. Affected by this vulnerability is the function COPY/MOVE of the component WebDAV Servic...

  5. CVE-2026-18585 GL.iNet MT2500 APPS-NAS nas-web.get_file_list heap-based overflow

    Published
    MediumCVSS 5.3 EPSS 0.51%

    A vulnerability was detected in GL.iNet MT3000, MT6000, BE9300, BE3600, MT3600BE, E5800, BE6500, MT5000, X3000, XE3000 and MT2500 up to 20260707. The affected element is the function nas-web.get_file_list of the component APPS-NAS Module. Performing a manipulation results in heap...

  6. CVE-2026-11505 GL.iNet XE3000 glnassys hard-coded key

    Published
    LowCVSS 2.3 EPSS 0.20%

    A flaw has been found in GL.iNet A1300, AX1800, AXT1800, MT2500, MT3000, MT6000, X3000 and XE3000 4.8.x. This affects an unknown function of the component glnassys. Executing a manipulation can lead to use of hard-coded cryptographic key . The attack may be launched remotely. The...

  7. CVE-2023-50920 An issue was discovered on GL.iNet devices before version 4.5.0. They assign the same session ID after each user reboot, allowing attackers to share session identifiers between different sessions and....

    Published
    MediumCVSS 5.5 EPSS 0.20%

    An issue was discovered on GL.iNet devices before version 4.5.0. They assign the same session ID after each user reboot, allowing attackers to share session identifiers between different sessions and bypass authentication or access control measures. Attackers can impersonate legi...

  8. CVE-2023-50445 Shell Injection vulnerability GL.iNet A1300 v4.4.6, AX1800 v4.4.6, AXT1800 v4.4.6, MT3000 v4.4.6, MT2500 v4.4.6, MT6000 v4.5.0, MT1300 v4.3.7, MT300N-V2 v4.3.7, AR750S v4.3.7, AR750 v4.3.7, AR300M v4....

    Published
    HighCVSS 7.8 EPSS 9.1% Framework module

    Shell Injection vulnerability GL.iNet A1300 v4.4.6, AX1800 v4.4.6, AXT1800 v4.4.6, MT3000 v4.4.6, MT2500 v4.4.6, MT6000 v4.5.0, MT1300 v4.3.7, MT300N-V2 v4.3.7, AR750S v4.3.7, AR750 v4.3.7, AR300M v4.3.7, and B1300 v4.3.7., allows local attackers to execute arbitrary code via the...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.