The company: what the public record shows
GL.iNet's website footer carries the copyright line GL Technologies (HK) Ltd, and its Beryl AX datasheet names GL Technologies (Hong Kong) Limited. GL.iNet's GitHub organisation lists its location as Hong Kong and its website as gl-inet.com. [1][6][12]
The company publishes code and documentation in the open. Its GitHub repositories include gl-feeds, which GL.iNet describes as packages missing from OpenWrt feeds or whose versions are too old, its documentation sources, a self-deployable KVM cloud and a CVE-issues repository. [12]
On security process, GL.iNet's Security Updates page says it discloses security vulnerabilities within 90 days of discovery, asks researchers to report flaws to [email protected], and lists dated advisories: router advisories on 1 December 2022, 18 May 2023, 29 April 2024, 1 August 2024, 14 October 2024 and 24 April 2025, and a KVM advisory on 15 April 2026. [1]
| Question | What the public record shows |
|---|---|
| Legal entity named on GL.iNet material | GL Technologies (HK) Ltd / GL Technologies (Hong Kong) Limited [1][6] |
| Location listed on its GitHub organisation | Hong Kong [12] |
| Software base | OpenWrt fork with GL.iNet's own web interface [6][7] |
| Vulnerability reporting | [email protected]; 90-day disclosure policy [1][13] |
| Support lifecycle | Up to two years after last manufacturing date, or longer if required by law [1] |
| Most recent router advisory on GL.iNet's page | 24 April 2025, when we checked on 30 October 2026 [1] |
OpenWrt underneath, GL.iNet's interface on top
OpenWrt describes itself as a highly extensible GNU/Linux distribution for embedded devices, typically wireless routers, with a writable filesystem and package management. GL.iNet's Beryl AX datasheet lists OpenWrt v21.02 as the operating system. [5][6]
OpenWrt's own device page for the GL-MT3000 says the router ships on a fork of OpenWrt with a custom web UI, and documents how to flash upstream OpenWrt from GL.iNet's interface or LuCI, choosing not to keep the configuration. That matters for safety in two ways: the base system gets the scrutiny of a large open-source project, and you have an exit to upstream OpenWrt if you stop trusting the vendor layer. [7]
The flip side is that GL.iNet's own additions, such as its admin interface, NAS, VPN and modem plugins, are where most of the 2026 vulnerability records point. [3][4]
What 2026 vulnerability records show
We queried the US National Vulnerability Database (NVD) API for the keyword GL.iNet in two 120-day windows. It returned 12 records published between 5 March and 2 July 2026 and 16 published between 3 July and 30 October 2026. Of those 28, 27 were filed by VulDB as the CVE numbering authority; the other, CVE-2023-46453, an authentication-bypass record for 4.x firmware first published to NVD on 8 May 2026, came from MITRE. [3][4]
The pattern is consistent: 22 of the 28 records describe command injection in GL.iNet firmware components, often in GL-MT3000 (Beryl AX) firmware up to 4.4.5 or across many models on 4.8.x, six carry a critical CVSS 3.1 score, and several state that upgrading to a newer release such as 4.9.0 resolves the issue. One record also covers GL.iNet's KVM line. [2][3][4][8]
| Record | Affected (per NVD) | Severity (CNA score) | Fix stated |
|---|---|---|---|
| CVE-2026-18601 | GL-MT3000 up to 4.4.5; ovpn-client check_config command injection; remote; public exploit noted | CVSS 3.1: 9.8 Critical | Vendor confirmed; no fixed version stated in the record [2] |
| CVE-2026-19982 | BE9300 and MT6000 4.8.x; firewall-management RPC command injection; remote | CVSS 3.1: 7.4 High | Upgrade to 4.9.0 [8] |
| CVE-2026-5959 | GL-RM1, GL-RM10, GL-RM10RC, GL-RM1PE 1.8.1; factory reset handler authentication; high complexity | CVSS 3.1: 6.6 Medium | Upgrade to 1.8.2 [9] |
How fixes reach your router
GL.iNet's lifecycle statement is the number to plan around: it supports products for up to two years after their last manufacturing date, or longer if required by law, and after end of service life products receive no firmware updates, including security patches. GL.iNet links a legacy (EoL) product page from the same statement. [1]
GL.iNet's April 2025 advisory shows how fixes are delivered: a table of affected and resolved firmware per model, with a strong recommendation to upgrade. For example, Beryl AX and Flint 2 on 4.7.0 and earlier were resolved in 4.7.4, and Opal on 4.3.24 and earlier in 4.3.25. It listed CVE-2024-57391 (command injection after authentication), CVE-2025-2811 (ReDoS without authentication), CVE-2025-2850 (unauthorized file download) and CVE-2025-2851 (buffer overflow in a plugin library), and said it does not include CVEs from OpenWrt itself. [13]
When we checked, the 2026 router records in NVD were not listed as a newer router advisory on GL.iNet's Security Updates page, whose most recent router entry was dated 24 April 2025. The NVD records we opened include the vendor's confirmation and, in several cases, the fixed version, so check both sources and simply stay on current firmware. [1][3][4][8]
- Online upgrade: the router checks the internet for the latest official firmware, then downloads and installs it; it needs an internet connection. [10]
- Local upgrade: download firmware from dl.gl-inet.com and upload it; this is also how you install a specific beta. [10]
- Keep Settings: retains your configuration, but user-installed packages must be reinstalled; do not use it when downgrading. [10]
- If the online check says Download Failed, GL.iNet says to check the time zone under System. [10]
- Never power off during an upgrade. [10]
Hardening checklist
These settings come from GL.iNet's own Security and admin password pages. None needs extra software. [11]
| Setting | Where | What to do |
|---|---|---|
| Admin password | SYSTEM, Security, Admin Password | Use 10 to 63 characters with at least two character types; make it unique [11] |
| Firmware | SYSTEM, Upgrade | Run the online upgrade, which checks for the latest official firmware [10] |
| HTTPS and SSH remote access | SYSTEM, Security, Remote Access Control | Leave off unless you need it; if on, use Allow Remote Access from Specific IPs [11] |
| Ping from WAN | Same section | Leave off unless you use it for monitoring [11] |
| Local SSH | Access Control | Enabled by default on port 22; disable if you never use it [11] |
| Force HTTPS and auto-logout | Access Control | Turn on Force HTTPS; auto-logout defaults to 5 minutes [11] |
| Open ports | Open Ports on Router | Remove rules you no longer need [11] |
Who should be comfortable, and who should think twice
If you update firmware, keep the admin panel off the internet, and buy a model that is still within GL.iNet's support lifecycle, the public record shows vulnerabilities being reported, confirmed and fixed in later firmware. [1][3][4][10][13]
If you cannot commit to updating, or you need a device you can audit end to end, consider running upstream OpenWrt on supported models, which OpenWrt documents for the GL-MT3000. Note that GL.iNet's warranty excludes unauthorized firmware replacement or modification. Our OpenWrt guide covers the trade-offs, and our firmware change plan covers how to switch without losing a working setup. [7][14]
Questions before you decide
Who makes GL.iNet routers?
GL.iNet's site carries the copyright line GL Technologies (HK) Ltd, its GitHub organisation lists Hong Kong as its location, and its datasheets name GL Technologies (Hong Kong) Limited. GL.iNet's routers ship with firmware built on OpenWrt.
Are there known vulnerabilities in GL.iNet firmware?
Yes. A keyword search of the NIST National Vulnerability Database returned 12 GL.iNet records published between 5 March and 2 July 2026 and 16 published between 3 July and 30 October 2026. Many describe command injection in 4.x firmware, and several state the fixed version, such as 4.9.0 for CVE-2026-19982 on the GL-BE9300 and GL-MT6000 (Flint 2).
Is GL.iNet firmware open source?
Partly. OpenWrt's device page says the GL-MT3000 ships on a fork of OpenWrt with a custom web UI, and GL.iNet publishes repositories such as gl-feeds on GitHub. The OpenWrt base is open source, but the pages we read do not say the GL.iNet web interface is.
What is the single most useful safety step?
Keep the firmware current. GL.iNet's upgrade page describes online upgrades from the admin panel, and the NVD records we checked name newer firmware such as 4.9.0 as the fix for the issues they describe.
Sources & verification
Product details and prices can change. Check the linked provider before buying.
- GL.iNet: Security Updates, disclosure policy and product lifecycle Accessed 30 Oct 2026
- NIST NVD API: CVE-2026-18601 (GL.iNet GL-MT3000 up to 4.4.5) Accessed 30 Oct 2026
- NIST NVD API: GL.iNet keyword search, records published 5 March to 2 July 2026 Accessed 30 Oct 2026
- NIST NVD API: GL.iNet keyword search, records published 3 July to 30 October 2026 Accessed 30 Oct 2026
- OpenWrt: About OpenWrt Accessed 30 Oct 2026
- GL.iNet: Beryl AX (GL-MT3000) datasheet, ver. 20250320 Accessed 30 Oct 2026
- OpenWrt Table of Hardware: GL.iNet GL-MT3000 Accessed 30 Oct 2026
- NIST NVD API: CVE-2026-19982 (GL.iNet BE9300 and MT6000 4.8.x) Accessed 30 Oct 2026
- NIST NVD API: CVE-2026-5959 (GL.iNet KVM 1.8.1) Accessed 30 Oct 2026
- GL.iNet Router Docs 4: Firmware upgrade Accessed 30 Oct 2026
- GL.iNet Router Docs 4: Security Accessed 30 Oct 2026
- GL.iNet on GitHub Accessed 30 Oct 2026
- GL.iNet: Security Advisories (Vulnerabilities and CVEs) April 24, 2025 Accessed 30 Oct 2026
- GL.iNet: Return and Warranty Policy Accessed 30 Oct 2026
Sources link directly to providers. Product buttons may use separately labeled affiliate links. Read our disclosure.