CVE-2026-18599: GL.iNet GL-MT3000 RCE Vulnerability

CVE-2026-18599 Overview

CVE-2026-18599 is a command injection vulnerability in GL.iNet GL-MT3000 routers running firmware up to version 4.4.5. The flaw resides in the logread.set_config function within /usr/lib/oui-httpd/rpc/logread, part of the Logread Lua RPC Plugin. Attackers can manipulate the record_size argument to inject arbitrary operating system commands. The vulnerability is classified under [CWE-74] (Improper Neutralization of Special Elements in Output Used by a Downstream Component). A public exploit has been released, and the vendor confirmed the flaw after early disclosure. Exploitation requires low-privileged access on an adjacent network segment.

Critical Impact
An authenticated attacker on an adjacent network can execute arbitrary commands on the router, leading to complete compromise of the device and pivoting into connected networks.

Affected Products

GL.iNet GL-MT3000 firmware versions up to and including 4.4.5
Logread Lua RPC Plugin (/usr/lib/oui-httpd/rpc/logread)
logread.set_config RPC function

Discovery Timeline

2026-08-03 - CVE-2026-18599 published to NVD
2026-08-03 - Last updated in NVD database

Technical Details for CVE-2026-18599

Vulnerability Analysis

The vulnerability exists in the logread.set_config RPC handler exposed by the oui-httpd daemon on the GL-MT3000 router. This Lua-based RPC endpoint accepts configuration parameters used to control system log behavior. The record_size parameter is passed to a downstream shell context without proper sanitization or neutralization of shell metacharacters. An attacker who can reach the RPC endpoint and supply a crafted record_size value achieves command injection under the privileges of the oui-httpd process. Because embedded router services typically run with elevated privileges, successful exploitation results in full device takeover, including modification of firewall rules, DNS settings, and firmware.

Root Cause

The root cause is improper neutralization of special elements passed to a downstream OS command interpreter, as described by [CWE-74]. The logread.set_config function concatenates the record_size argument into a system command string rather than validating that the input is numeric or escaping shell metacharacters. Lua RPC handlers in oui-httpd invoke shell utilities using os.execute or io.popen patterns, both of which spawn a shell that interprets injected metacharacters.

Attack Vector

Exploitation requires network adjacency to the router and a low-privileged authenticated session with the oui-httpd RPC interface. The attacker submits a JSON-RPC request to the logread.set_config method with a record_size payload containing shell metacharacters such as ;, backticks, or $() to append arbitrary commands. The injected command executes on the router with the daemon's privileges. A public proof of concept is available through the GitHub CVE Documentation, confirming reliable exploitation.

See the VulDB Vulnerability Report for additional technical details on the injection mechanism.

Detection Methods for CVE-2026-18599

Indicators of Compromise

Unexpected outbound connections initiated by the router shortly after RPC traffic to /rpc/logread
New or modified files in /tmp or /etc on the router filesystem
Presence of shell metacharacters (;, |, `, $()) in record_size values within oui-httpd request logs
Unauthorized changes to iptables rules, DNS resolvers, or router credentials

Detection Strategies

Monitor oui-httpd HTTP access logs for POST requests targeting logread.set_config with non-numeric record_size values
Alert on router-originated processes spawning shells (sh, busybox) with unusual command lines
Inspect network traffic to the router management interface from adjacent hosts that do not normally administer the device

Monitoring Recommendations

Forward router syslog data to a centralized SIEM for correlation of RPC activity with downstream process execution
Baseline legitimate configuration RPC calls and flag deviations in argument types or lengths
Track firmware version inventory to identify GL-MT3000 devices running vulnerable releases up to 4.4.5

How to Mitigate CVE-2026-18599

Immediate Actions Required

Restrict access to the router management interface to trusted management VLANs and administrator hosts only
Rotate router administrative credentials and disable unused accounts on the oui-httpd service
Audit connected devices and network configuration for signs of tampering following the disclosure
Monitor the VulDB CVE Entry and GL.iNet vendor channels for a firmware update addressing the flaw

Patch Information

As of publication, no fixed firmware version has been listed in the enriched CVE data. GL.iNet confirmed the vulnerability after early disclosure. Administrators should apply firmware updates released after version 4.4.5 as soon as they become available and verify that the logread.set_config handler validates record_size as a numeric value.

Workarounds

Block network access to the oui-httpd RPC endpoint from untrusted adjacent networks using upstream firewall rules
Disable remote management and Wi-Fi access to the administrative interface where not required
Segment IoT and guest networks so that only authorized management stations can reach the router control plane
Remove or restrict low-privileged accounts that can authenticate to the RPC interface until a patch is applied

bash

# Configuration example: restrict management interface access on an upstream firewall
iptables -I FORWARD -d <router_mgmt_ip> -p tcp --dport 80 -s <trusted_admin_subnet> -j ACCEPT
iptables -I FORWARD -d <router_mgmt_ip> -p tcp --dport 80 -j DROP
iptables -I FORWARD -d <router_mgmt_ip> -p tcp --dport 443 -s <trusted_admin_subnet> -j ACCEPT
iptables -I FORWARD -d <router_mgmt_ip> -p tcp --dport 443 -j DROP