CVE-2026-18787: GL.iNet AX1800 RCE Vulnerability

CVE-2026-18787 Overview

CVE-2026-18787 is a command injection vulnerability affecting GL.iNet AX1800 routers running firmware versions up to 4.8.3. The flaw resides in the remove_rule function within /usr/share/gl-ngx/oui-rpc.lua, part of the router's RPC Endpoint component. Attackers can inject arbitrary operating system commands by manipulating the args.id parameter. The vulnerability is remotely exploitable and requires only low-privilege authentication. A public exploit is available, increasing the risk of active abuse. The weakness is classified under [CWE-74] (Improper Neutralization of Special Elements in Output Used by a Downstream Component).

Critical Impact
Authenticated remote attackers can execute arbitrary commands on affected GL.iNet AX1800 routers, compromising confidentiality, integrity, and availability of the device and connected network segments.

Affected Products

GL.iNet AX1800 router firmware versions up to and including 4.8.3
Component: RPC Endpoint (/usr/share/gl-ngx/oui-rpc.lua)
Vulnerable function: remove_rule

Discovery Timeline

2026-08-04 - CVE-2026-18787 published to NVD
2026-08-04 - Last updated in NVD database

Technical Details for CVE-2026-18787

Vulnerability Analysis

The vulnerability exists in the remove_rule function of the Lua script /usr/share/gl-ngx/oui-rpc.lua, which is exposed through the router's RPC (Remote Procedure Call) endpoint. This RPC endpoint handles administrative operations for the GL.iNet AX1800 web interface. The remove_rule handler accepts a client-supplied args.id argument and passes it into a downstream shell command without adequate sanitization. Because the value flows into a system-level command context, an attacker can append shell metacharacters to break out of the intended argument and execute arbitrary commands under the privileges of the RPC service, typically root on embedded OpenWrt-based devices.

Root Cause

The root cause is improper neutralization of special elements before use in a downstream shell invocation, mapped to [CWE-74]. The Lua handler treats args.id as trusted input, concatenating or interpolating it into a command string executed by the underlying operating system. No allowlist, escaping, or parameterized execution mechanism is applied.

Attack Vector

Exploitation requires network access to the RPC endpoint and a low-privilege authenticated session on the router. Once authenticated, an attacker issues a crafted RPC call to remove_rule with a malicious args.id value containing shell metacharacters such as ;, |, or backticks. The injected commands execute with the privileges of the web/RPC daemon. Successful exploitation yields full device compromise, including credential extraction, firmware modification, traffic interception, and pivoting into the LAN.

No verified exploit code is reproduced here. Technical details are available in the GitHub IoT Documentation and the VulDB CVE-2026-18787 entry.

Detection Methods for CVE-2026-18787

Indicators of Compromise

Unexpected POST or RPC requests to the oui-rpc endpoint containing shell metacharacters (;, |, &, `, $() inside the id parameter.
Child processes such as sh, busybox, wget, or curl spawned by the gl-ngx or Lua RPC service outside of normal administrative windows.
Outbound connections from the router to unfamiliar hosts shortly after RPC activity.
New or modified startup scripts under /etc/rc.d/, /etc/init.d/, or /etc/crontabs/ on the device.

Detection Strategies

Inspect gl-ngx and web server access logs for requests to RPC methods invoking remove_rule with non-numeric or metacharacter-laden id values.
Correlate authenticated router sessions with process-execution telemetry to flag command spawns rooted in the RPC handler.
Deploy network signatures on management VLANs matching malformed oui-rpc payloads containing shell operators.

Monitoring Recommendations

Forward router syslog to a central log platform and alert on Lua script errors or unexpected execute/popen invocations.
Baseline normal administrative RPC traffic and alert on deviations in request frequency, source, or payload structure.
Monitor firmware integrity and configuration checksums on managed GL.iNet devices to detect tampering.

How to Mitigate CVE-2026-18787

Immediate Actions Required

Restrict RPC and web management access to trusted management networks only; block WAN-side exposure of the administrative interface.
Rotate all administrative credentials on affected AX1800 devices and disable unused local accounts.
Audit router logs and running configuration for signs of prior exploitation before applying updates.
Track vendor advisories from GL.iNet for a firmware release addressing versions beyond 4.8.3.

Patch Information

At the time of publication, no fixed firmware version is referenced in the NVD entry for CVE-2026-18787. Administrators should monitor the VulDB entry for CVE-2026-18787 and GL.iNet's official firmware release channel for updates that address the remove_rule handler in /usr/share/gl-ngx/oui-rpc.lua. Apply the vendor-supplied firmware update as soon as it is available and validate the fix in a test environment before broad deployment.

Workarounds

Place affected routers behind a segmented management network and enforce ACLs limiting access to the RPC endpoint.
Disable remote administration features and require VPN access for any management activity.
Where feasible, apply local firewall rules on the device to restrict RPC access to specific administrator IP addresses.
Replace or decommission end-of-life AX1800 units if no patched firmware is released within an acceptable exposure window.

bash

# Configuration example: restrict management access on GL.iNet OpenWrt-based devices
uci set firewall.@zone[0].input='DROP'
uci add firewall rule
uci set firewall.@rule[-1].name='Allow-Mgmt-From-Admin-Subnet'
uci set firewall.@rule[-1].src='lan'
uci set firewall.@rule[-1].src_ip='192.0.2.0/24'
uci set firewall.@rule[-1].dest_port='80 443'
uci set firewall.@rule[-1].target='ACCEPT'
uci commit firewall
/etc/init.d/firewall restart