CVE-2026-19981

CVE-2026-19981 is command injection in GL.iNet's power scheduling feature, affecting 17 models from the A1300 through the BE10000—a span suggesting the same architectural pattern persisted across 6-8 years of product development. The analytically significant dimension isn't the injection itself; it's that this vulnerability lives in a feature users interact with regularly, embedded in scheduled execution. This changes the threat model fundamentally: exploitation isn't a one-time event but a persistent foothold. An attacker injects commands into the schedule, and they fire every night at the configured time, surviving reboots and blending into normal device behavior. The CVSS 7.4 captures a single injection event—it does not model a persistent execution environment inside your network. Prioritize determining whether the power scheduling interface is accessible pre-authentication or requires authenticated access, since this determines whether this is initial access or privilege escalation. Examine the switch_power/restore_power argument handling to understand the exact parsing failure—variable expansion, command chaining, or direct shell passthrough. More critically, verify whether GL.iNet's fix addresses the architectural pattern (UI input reaching shell) or merely sanitizes the specific arguments; argument-level sanitization in shell-mediated code is notoriously brittle. Treat scheduled execution as a monitoring surface: power schedules fire at known times with known parameters, creating detection opportunities that most security tooling ignores because power scheduling has been relegated to "forgotten infrastructure." This vulnerability class—shell-as-integration-layer in consumer IoT convenience features—has appeared repeatedly across Linksys, Netgear, and TP-Link. The pattern is documented; the recurrence suggests the development workflow isn't connecting to that documentation.

Reviewed through automated stages and approved by a human before publication.