CVE-2026-18598: GL.iNet GL-MT3000 RCE Vulnerability

CVE-2026-18598 Overview

CVE-2026-18598 is a command injection vulnerability in the GL.iNet GL-MT3000 router firmware up to version 4.4.5. The flaw resides in the logread.get_system_log function within the /usr/lib/oui-httpd/rpc/logread Logread Lua RPC plugin. An authenticated remote attacker can manipulate the module argument to inject arbitrary operating system commands. The vendor confirmed the vulnerability after early disclosure, and a public exploit is available. Successful exploitation grants command execution on the router with the privileges of the RPC handler process, exposing traffic, credentials, and downstream network segments.

Critical Impact
Remote attackers with low-privilege access can execute arbitrary commands on the router, compromising confidentiality, integrity, and availability of the device and connected network.

Affected Products

GL.iNet GL-MT3000 firmware versions up to and including 4.4.5
Logread Lua RPC plugin at /usr/lib/oui-httpd/rpc/logread
oui-httpd RPC interface exposing logread.get_system_log

Discovery Timeline

2026-08-03 - CVE-2026-18598 published to the National Vulnerability Database (NVD)
2026-08-03 - Last updated in NVD database

Technical Details for CVE-2026-18598

Vulnerability Analysis

The vulnerability is a Command Injection classified under [CWE-74] (Improper Neutralization of Special Elements in Output Used by a Downstream Component). The logread.get_system_log function in the Logread Lua RPC plugin passes the module parameter into a shell command without adequate sanitization. An attacker who reaches the oui-httpd RPC endpoint can supply shell metacharacters within the module argument to break out of the intended command context. This yields command execution on the underlying OpenWrt-based operating system. Because the router mediates all network traffic, code execution here allows attackers to intercept sessions, pivot to LAN hosts, and persist across reboots by modifying firmware components.

Root Cause

The root cause is the concatenation of attacker-controlled input into a shell invocation used by the logread RPC method. The Lua plugin trusts the module parameter as a benign identifier and does not enforce an allow-list or escape shell metacharacters. Any request that supplies characters such as ;, |, backticks, or $() injects new commands into the invocation.

Attack Vector

Exploitation occurs over the network against the oui-httpd RPC service. The attacker requires low-privilege authentication to reach the RPC method. A crafted JSON-RPC request targeting logread.get_system_log with a malicious module value triggers execution of injected commands under the router's service account. The public availability of exploit code lowers the barrier to weaponization.

No verified proof-of-concept code is included here. The GitHub CVE Markdown Document contains the full technical write-up and exploitation details.

Detection Methods for CVE-2026-18598

Indicators of Compromise

HTTP requests to /rpc or oui-httpd endpoints invoking the logread.get_system_log method with shell metacharacters (;, |, &, backticks, $()) in the module parameter
Unexpected child processes spawned by oui-httpd or lua on the router, such as sh, wget, curl, nc, or busybox invocations
Outbound connections from the router to attacker-controlled infrastructure following RPC activity

Detection Strategies

Inspect oui-httpd access logs for POST requests to the logread RPC method containing non-alphanumeric characters in the module argument
Correlate authenticated RPC sessions with subsequent shell process creation events on the device
Monitor for firmware or configuration modification events shortly after RPC calls to logread endpoints

Monitoring Recommendations

Forward router syslog and oui-httpd logs to a centralized SIEM for retention and correlation
Baseline normal RPC method usage and alert on anomalous module argument content
Track egress traffic from management-plane devices to detect post-exploitation callbacks

How to Mitigate CVE-2026-18598

Immediate Actions Required

Restrict access to the router administrative interface and oui-httpd RPC endpoint to trusted management networks only
Rotate all administrative credentials on affected GL-MT3000 devices to invalidate stolen low-privilege accounts
Disable remote WAN-side administration until a patched firmware is installed
Audit routers for unauthorized processes, cron entries, and modified configuration files

Patch Information

GL.iNet confirmed the vulnerability after coordinated disclosure. Consult the VulDB CVE #CVE-2026-18598 entry and the GL.iNet firmware download portal for the latest GL-MT3000 firmware release addressing this issue. Apply the vendor-supplied firmware update immediately after verifying its integrity.

Workarounds

Block external access to the router web UI and RPC ports at the perimeter
Enforce strong, unique credentials on all router accounts to reduce the pool of authenticated attackers
Segment the router management VLAN so only authorized administrator hosts can reach oui-httpd
Disable or remove unused RPC plugins in /usr/lib/oui-httpd/rpc/ where operationally feasible

bash

# Configuration example: restrict oui-httpd access via firewall on the router
uci add firewall rule
uci set firewall.@rule[-1].name='Restrict-oui-httpd'
uci set firewall.@rule[-1].src='wan'
uci set firewall.@rule[-1].proto='tcp'
uci set firewall.@rule[-1].dest_port='80 443'
uci set firewall.@rule[-1].target='DROP'
uci commit firewall
/etc/init.d/firewall restart