CVE-2026-5959
Full vulnerability record from the local CVENow database.
Description
A security flaw has been discovered in GL.iNet GL-RM1, GL-RM10, GL-RM10RC and GL-RM1PE 1.8.1. Affected by this issue is some unknown functionality of the component Factory Reset Handler. Performing a manipulation results in improper authentication. The attack can be initiated remotely. The complexity of an attack is rather high. The exploitation is known to be difficult. Upgrading to version 1.8.2 can resolve this issue. It is advisable to upgrade the affected component. The vendor was contacted early, responded in a very professional manner and quickly released a fixed version of the affected product.
Severity
HIGH
CVSS score
7.5
(v4.0)
Vulnerability status
Deferred
Source identifier
Published
2026-04-09 15:16:17.760000
Last modified
2026-10-26 21:10:00.170000
View original CVE JSON
{
"id": "CVE-2026-5959",
"sourceIdentifier": "[email protected]",
"published": "2026-04-09T15:16:17.760",
"lastModified": "2026-10-26T21:10:00.170",
"vulnStatus": "Deferred",
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "A security flaw has been discovered in GL.iNet GL-RM1, GL-RM10, GL-RM10RC and GL-RM1PE 1.8.1. Affected by this issue is some unknown functionality of the component Factory Reset Handler. Performing a manipulation results in improper authentication. The attack can be initiated remotely. The complexity of an attack is rather high. The exploitation is known to be difficult. Upgrading to version 1.8.2 can resolve this issue. It is advisable to upgrade the affected component. The vendor was contacted early, responded in a very professional manner and quickly released a fixed version of the affected product."
},
{
"lang": "es",
"value": "Una falla de seguridad ha sido descubierta en GL.iNet GL-RM1, GL-RM10, GL-RM10RC y GL-RM1PE 1.8.1. Afectada por este problema es alguna funcionalidad desconocida del componente Gestor de Restablecimiento de Fábrica. Realizar una manipulación resulta en autenticación impropia. El ataque puede ser iniciado remotamente. La complejidad de un ataque es bastante alta. La explotación se sabe que es difícil. Actualizar a la versión 1.8.2 puede resolver este problema. Es aconsejable actualizar el componente afectado. El proveedor fue contactado tempranamente, respondió de una manera muy profesional y rápidamente lanzó una versión corregida del producto afectado."
}
],
"affected": [
{
"source": "[email protected]",
"affectedData": [
{
"vendor": "GL.iNet",
"product": "GL-RM1",
"modules": [
"Factory Reset Handler"
],
"versions": [
{
"version": "1.8.1",
"status": "affected"
},
{
"version": "1.8.2",
"status": "unaffected"
}
]
},
{
"vendor": "GL.iNet",
"product": "GL-RM10",
"modules": [
"Factory Reset Handler"
],
"versions": [
{
"version": "1.8.1",
"status": "affected"
},
{
"version": "1.8.2",
"status": "unaffected"
}
]
},
{
"vendor": "GL.iNet",
"product": "GL-RM10RC",
"modules": [
"Factory Reset Handler"
],
"versions": [
{
"version": "1.8.1",
"status": "affected"
},
{
"version": "1.8.2",
"status": "unaffected"
}
]
},
{
"vendor": "GL.iNet",
"product": "GL-RM1PE",
"modules": [
"Factory Reset Handler"
],
"versions": [
{
"version": "1.8.1",
"status": "affected"
},
{
"version": "1.8.2",
"status": "unaffected"
}
]
}
]
}
],
"metrics": {
"cvssMetricV40": [
{
"source": "[email protected]",
"type": "Secondary",
"cvssData": {
"version": "4.0",
"vectorString": "CVSS:4.0/AV:N/AC:H/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"attackVector": "NETWORK",
"attackComplexity": "HIGH",
"attackRequirements": "NONE",
"privilegesRequired": "HIGH",
"userInteraction": "NONE",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH",
"vulnAvailabilityImpact": "HIGH",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"subAvailabilityImpact": "NONE",
"exploitMaturity": "NOT_DEFINED",
"confidentialityRequirement": "NOT_DEFINED",
"integrityRequirement": "NOT_DEFINED",
"availabilityRequirement": "NOT_DEFINED",
"modifiedAttackVector": "NOT_DEFINED",
"modifiedAttackComplexity": "NOT_DEFINED",
"modifiedAttackRequirements": "NOT_DEFINED",
"modifiedPrivilegesRequired": "NOT_DEFINED",
"modifiedUserInteraction": "NOT_DEFINED",
"modifiedVulnConfidentialityImpact": "NOT_DEFINED",
"modifiedVulnIntegrityImpact": "NOT_DEFINED",
"modifiedVulnAvailabilityImpact": "NOT_DEFINED",
"modifiedSubConfidentialityImpact": "NOT_DEFINED",
"modifiedSubIntegrityImpact": "NOT_DEFINED",
"modifiedSubAvailabilityImpact": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"valueDensity": "NOT_DEFINED",
"vulnerabilityResponseEffort": "NOT_DEFINED",
"providerUrgency": "NOT_DEFINED"
}
}
],
"cvssMetricV31": [
{
"source": "[email protected]",
"type": "Secondary",
"cvssData": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H",
"baseScore": 6.6,
"baseSeverity": "MEDIUM",
"attackVector": "NETWORK",
"attackComplexity": "HIGH",
"privilegesRequired": "HIGH",
"userInteraction": "NONE",
"scope": "UNCHANGED",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"availabilityImpact": "HIGH"
},
"exploitabilityScore": 0.7,
"impactScore": 5.9
}
],
"cvssMetricV2": [
{
"source": "[email protected]",
"type": "Secondary",
"cvssData": {
"version": "2.0",
"vectorString": "AV:N/AC:H/Au:M/C:C/I:C/A:C",
"baseScore": 6.8,
"accessVector": "NETWORK",
"accessComplexity": "HIGH",
"authentication": "MULTIPLE",
"confidentialityImpact": "COMPLETE",
"integrityImpact": "COMPLETE",
"availabilityImpact": "COMPLETE"
},
"baseSeverity": "MEDIUM",
"exploitabilityScore": 3.2,
"impactScore": 10.0,
"acInsufInfo": false,
"obtainAllPrivilege": false,
"obtainUserPrivilege": false,
"obtainOtherPrivilege": false,
"userInteractionRequired": false
}
],
"ssvcV203": [
{
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"ssvcData": {
"timestamp": "2026-04-13T20:01:45.933133Z",
"id": "CVE-2026-5959",
"options": [
{
"exploitation": "none"
},
{
"automatable": "no"
},
{
"technicalImpact": "total"
}
],
"role": "CISA Coordinator",
"version": "2.0.3"
}
}
]
},
"weaknesses": [
{
"source": "[email protected]",
"type": "Secondary",
"description": [
{
"lang": "en",
"value": "CWE-287"
}
]
}
],
"references": [
{
"url": "https://dl.gl-inet.com/kvm/",
"source": "[email protected]"
},
{
"url": "https://github.com/gl-inet/CVE-issues/blob/main/KVM/1.8.1/Remote%20Access%20Authentication%20Bypass%20After%20Factory%20Reset.md",
"source": "[email protected]"
},
{
"url": "https://vuldb.com/submit/786688",
"source": "[email protected]"
},
{
"url": "https://vuldb.com/vuln/356512",
"source": "[email protected]"
},
{
"url": "https://vuldb.com/vuln/356512/cti",
"source": "[email protected]"
}
]
}