CVE-2026-5959: Improper Authentication in GL.iNet Router Firmware

This vulnerability allows a remote attacker to bypass authentication mechanisms within the Factory Reset Handler. While the attack complexity is considered high and exploitation difficult, a successful breach could grant the attacker control over the router's configuration and potentially its network traffic. This could lead to data theft, man-in-the-middle attacks, or even complete compromise of the network the router protects. The impact is amplified in environments where these routers are used as primary internet gateways or for sensitive data transmission.

1. Reserved2026-04-09
2. Published2026-04-09
3. Modified2026-04-13
4. EPSS updated2026-04-17

The primary mitigation for CVE-2026-5959 is to upgrade the GL.iNet router firmware to version 1.8.2 or later. This update directly addresses the improper authentication flaw. If an immediate upgrade is not feasible due to compatibility issues or downtime concerns, consider implementing stricter firewall rules to limit access to the Factory Reset Handler functionality. While a WAF is unlikely to be effective here, carefully reviewing and restricting access to the router's web interface can reduce the attack surface. After upgrading, confirm the fix by attempting a factory reset and verifying that authentication is required.