CVE-2026-18585 Overview
CVE-2026-18585 is a heap-based buffer overflow vulnerability affecting multiple GL.iNet router models running firmware up to version 20260707. The flaw resides in the nas-web.get_file_list function within the APPS-NAS module. An authenticated remote attacker can trigger memory corruption by manipulating input processed by this function, resulting in a denial-of-service condition. The vendor confirmed the vulnerability after coordinated disclosure. The weakness is tracked under CWE-119 (Improper Restriction of Operations within the Bounds of a Memory Buffer).
Critical Impact
An authenticated attacker on the network can remotely crash the NAS service on affected GL.iNet routers, disrupting file-sharing functionality and potentially the device itself.
Affected Products
- GL.iNet MT3000, MT6000, MT5000, MT2500, MT3600BE routers running firmware up to 20260707
- GL.iNet BE9300, BE3600, BE6500, XE3000, X3000 routers running firmware up to 20260707
- GL.iNet E5800 mobile router running firmware up to 20260707
Discovery Timeline
- 2026-08-03 - CVE-2026-18585 published to NVD
- 2026-08-03 - Last updated in NVD database
Technical Details for CVE-2026-18585
Vulnerability Analysis
The vulnerability exists in the nas-web.get_file_list function of the APPS-NAS module, which handles file enumeration requests for network-attached storage functionality on GL.iNet routers. When an authenticated user submits crafted input to this endpoint, the function fails to properly validate or bound the data before writing it to a heap-allocated buffer. This results in a heap-based buffer overflow, corrupting adjacent heap memory structures.
The overflow leads to an authenticated denial-of-service condition, causing the NAS service or the underlying process to crash. Because the affected code path runs on the router's web management interface, exploitation only requires network reachability to the device and valid low-privilege credentials.
Root Cause
The root cause is insufficient validation of the length or structure of input data passed to nas-web.get_file_list before it is copied into a fixed-size heap buffer. The function does not enforce boundary checks consistent with the destination buffer capacity, allowing an attacker-controlled write to exceed allocated memory. This class of defect is characterized by CWE-119.
Attack Vector
An attacker requires network access to the router's web interface and valid authenticated credentials (low-privilege user). Once authenticated, the attacker sends a crafted request to the NAS file-listing endpoint containing malformed or oversized parameters. Processing this request triggers the overflow and crashes the service. The vulnerability is exploitable remotely over the network with low attack complexity.
See the GitHub CVE Issues Report for the technical write-up published by the vendor's disclosure repository.
Detection Methods for CVE-2026-18585
Indicators of Compromise
- Unexpected restarts or crashes of the nas-web process or NAS-related services on GL.iNet routers.
- HTTP requests to the NAS file listing endpoint containing abnormally long or malformed parameters.
- Repeated authenticated requests from a single source targeting the APPS-NAS module immediately preceding service failure.
Detection Strategies
- Inspect router system logs for segmentation faults, out-of-memory events, or watchdog-triggered service restarts tied to the NAS component.
- Monitor the web management interface for authenticated sessions issuing repeated file-listing requests with unusual payload sizes.
- Correlate authentication events with subsequent service disruption to identify malicious low-privilege users.
Monitoring Recommendations
- Forward router syslog output to a centralized logging platform to retain crash and process-restart evidence.
- Alert on any anomalous restart pattern of the NAS or web management services on GL.iNet devices.
- Track authenticated session activity against the router web UI and flag accounts issuing malformed NAS requests.
How to Mitigate CVE-2026-18585
Immediate Actions Required
- Apply firmware updates released by GL.iNet as soon as they are available for the affected models.
- Restrict access to the router's web management interface to trusted management networks only.
- Rotate credentials for any low-privilege accounts on the affected routers and enforce strong password policies.
- Disable the NAS/file-sharing feature on affected devices where it is not required for business operations.
Patch Information
GL.iNet was contacted before disclosure and confirmed the vulnerability. Refer to the GL.iNet CVE issues repository and the VulDB entry for CVE-2026-18585 for the latest firmware guidance for each affected model.
Workarounds
- Disable the APPS-NAS module or unmount attached storage until a patched firmware version is installed.
- Block external access to the router's web administration port and permit management traffic only from an internal management VLAN.
- Limit the number of authenticated user accounts on the router and remove any accounts that do not require access.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
