PT-2026-47268 · Gl.Inet · Axt1800+6

Glinet · Published 2026-06-08 · Updated 2026-06-08 · CVE-2026-11505

Positive Technologies (AI Summary)

CVSS v3.1

5.0

Medium

Base vector

AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L

Name of the Vulnerable Software and Affected Versions GL.iNet A1300 versions prior to 4.9.0 GL.iNet AX1800 versions prior to 4.9.0 GL.iNet AXT1800 versions prior to 4.9.0 GL.iNet MT2500 versions prior to 4.9.0 GL.iNet MT3000 versions prior to 4.9.0 GL.iNet MT6000 versions prior to 4.9.0 GL.iNet X3000 versions prior to 4.9.0 GL.iNet XE3000 versions prior to 4.9.0

Description A flaw in the glnassys component allows a remote attacker to manipulate the system, leading to the use of a hard-coded cryptographic key. This attack is characterized by high complexity and is reported as difficult to exploit.

Recommendations Update to version 4.9.0 Upgrade the glnassys component

Exploit

Fix

Weakness Enumeration

CWE-320

CWE-321

Related Identifiers

CVE-2026-11505

Affected Products

A1300

Axt1800

Mt2500

Mt3000

Mt6000

X3000

Xe3000

References · 8

• 🔥 https://github.com/gl-inet/CVE-issues/blob/main/4.0.0/The%20hard%20coded%20default%20authentication%20token%20in%20gl%20nas%20sys%20poses%20a%20risk%20to%20unauthorized%20command%20execution.md · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-11505 · Security Note
• https://cloud-static-test.gl-inet.cn/security/openwrt-ipq60xx-glinet_ax1800-squashfs-sysupgrade.tar · Patch
• https://vuldb.com/submit/835698 · Note
• https://vuldb.com/cve/CVE-2026-11505 · Note
• https://vuldb.com/vuln/369125 · Note
• https://vuldb.com/vuln/369125/cti · Note
• https://twitter.com/CVEnew/status/2063958166769991719 · Twitter Post