CVE-2026-18584: GL.iNet Router Auth Bypass Vulnerability

CVE-2026-18584 Overview

CVE-2026-18584 is an improper authorization vulnerability affecting GL.iNet E5800, E750, X2000, X3000, XE3000, and XE300 routers running firmware up to version 20260707. The flaw resides in the eSIM Local Profile Assistant (LPA) API exposed under the /sdk/v1 path. An attacker on the adjacent network can bypass the nginx proxy configuration and reach the API without authentication. GL.iNet confirmed the issue after early disclosure. The weakness is classified under [CWE-266: Incorrect Privilege Assignment].

Critical Impact
An unauthenticated attacker on the local network can invoke privileged eSIM LPA API operations, leading to limited disclosure and modification of eSIM profile data on affected GL.iNet devices.

Affected Products

GL.iNet E5800, E750 routers (firmware up to 20260707)
GL.iNet X2000, X3000, XE3000 routers (firmware up to 20260707)
GL.iNet XE300 router (firmware up to 20260707)

Discovery Timeline

2026-08-03 - CVE-2026-18584 published to the National Vulnerability Database (NVD)
2026-08-03 - Last updated in NVD database

Technical Details for CVE-2026-18584

Vulnerability Analysis

The affected GL.iNet devices expose an eSIM LPA API intended for internal or authenticated use. An nginx reverse proxy on the device is expected to enforce access controls before requests reach the backend API. The proxy configuration fails to consistently apply authorization rules to requests targeting /sdk/v1, permitting unauthenticated callers on the adjacent network to invoke API functions directly. The result is improper authorization on an API that manages eSIM profile operations. Successful requests can influence eSIM state without valid credentials.

Root Cause

The root cause is an nginx proxy configuration that does not gate the /sdk/v1 eSIM LPA API behind authentication or session validation. Because access control is enforced at the proxy layer rather than in the backend service, any request path that bypasses the proxy check reaches the API with implicit privilege. This aligns with [CWE-266], where privilege is granted incorrectly through configuration rather than explicit authorization.

Attack Vector

Exploitation requires network adjacency to the target router, typically meaning the attacker sits on the same LAN or Wi-Fi segment. The attacker sends crafted HTTP requests to the /sdk/v1 endpoint of the eSIM LPA API. Because the proxy does not authenticate these requests, the API processes them as trusted. No user interaction or credentials are required. Further technical detail is available in the GitHub CVE-Analysis Document and the VulDB CVE-2026-18584 entry.

Detection Methods for CVE-2026-18584

Indicators of Compromise

Unexpected HTTP requests to /sdk/v1 on affected GL.iNet devices originating from LAN clients that do not require eSIM management.
eSIM profile state changes (enable, disable, delete, download) that do not correlate with legitimate administrator activity.
nginx access log entries showing /sdk/v1 requests without a preceding authenticated session.

Detection Strategies

Enable and forward nginx access and error logs from GL.iNet devices to a centralized logging or SIEM platform for review.
Baseline legitimate /sdk/v1 request sources and alert on requests originating from unmanaged or guest network segments.
Correlate eSIM LPA API calls with authenticated administrator sessions; flag calls that lack a matching session.

Monitoring Recommendations

Monitor LAN traffic to router management interfaces for anomalous HTTP methods and paths targeting eSIM endpoints.
Track firmware versions across the fleet and alert on devices running firmware at or below 20260707.
Review authentication logs for absence of login events preceding privileged API calls.

How to Mitigate CVE-2026-18584

Immediate Actions Required

Apply the firmware update published by GL.iNet for E5800, E750, X2000, X3000, XE3000, and XE300 models as soon as it is available.
Restrict LAN access to the router management interface using VLAN segmentation or firewall rules until patched.
Disable eSIM LPA functionality on devices where it is not required for operations.

Patch Information

GL.iNet confirmed the vulnerability following coordinated disclosure. Refer to the GL.iNet CVE-issues repository for the vendor's technical write-up and monitor the vendor's firmware release channel for versions later than 20260707 that address the nginx proxy bypass.

Workarounds

Isolate affected routers on a dedicated management VLAN and limit which client subnets can reach the router web interface.
Deploy Wi-Fi network segmentation so untrusted or guest clients cannot reach the router's LAN-side management endpoints.
Enforce strong Wi-Fi authentication (WPA2/WPA3 with unique passphrases) to reduce the pool of adjacent-network attackers.

bash

# Example: restrict access to the router management interface to a trusted subnet
# (run on an upstream firewall or on the router if iptables is available)
iptables -A INPUT -p tcp --dport 80  -s 192.0.2.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 443 -s 192.0.2.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 80  -j DROP
iptables -A INPUT -p tcp --dport 443 -j DROP