CVE-2026-19979

This CVE represents a code-path defect, not a systemic authentication failure. The key technical distinction: COPY and MOVE operations bypass authorization checks while other WebDAV methods (PUT, DELETE, GET) enforce them correctly. This points to a bug in how these two specific operations inherit session state from a shared handler, rather than an entire service lacking authentication. The compound nature of COPY and MOVE (read-then-write) amplifies the risk—an attacker gains unauthorized read access to whatever resources the WebDAV service can reach, followed by unauthorized write to a destination they control, in a single atomic operation they shouldn't be able to perform at all. On a SOHO router running as root—where configuration state, VPN credentials, and captive portal tokens often reside—this translates to a potential lateral movement primitive through the device's own datastore, not merely 'copying a file.' The seventeen-model affected roster spanning MT2500/MT3000 through BE10000, all sharing 4.8.x as the vulnerable baseline, indicates the flaw lives in shared library code that got replicated without independent security review across hardware generations. This pattern mirrors a known vulnerability genotype in embedded WebDAV implementations where COPY and MOVE become 'forgotten operations'—implemented for RFC compliance but rarely tested, making them susceptible to authorization drift during subsequent code changes. Verify whether WebDAV is enabled and restrict it to trusted networks; disable if unused. Monitor logs for anomalous COPY/MOVE operations. The vendor has confirmed the vulnerability but hasn't published remediation timing—treat this as a pending patch and prioritize network segmentation controls in the interim.

Reviewed through automated stages and approved by a human before publication.