CVE-2026-18584 in E5800
Summary
by MITRE • 08/03/2026
A security vulnerability has been detected in GL.iNet E5800, E750, X2000, X3000, XE3000 and XE300 up to 20260707. Impacted is an unknown function of the file /sdk/v1 of the component eSIM LPA API. Such manipulation leads to improper authorization. The attack can only be initiated within the local network. The vendor was contacted early about this disclosure and confirmed the existence of the vulnerability.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 08/03/2026
This vulnerability affects GL.iNet E5800, E750, X2000, X3000, XE3000, and XE300 devices running firmware versions up to 20260707, specifically targeting the eSIM LPA API component located in the /sdk/v1 directory. The flaw represents a critical authorization bypass issue that allows attackers to manipulate the eSIM provisioning process without proper authentication credentials. This vulnerability falls under CWE-285, which addresses improper authorization within software systems, and aligns with ATT&CK technique T1078.004 for valid accounts, as it enables unauthorized access to sensitive telecommunications functions through manipulation of API endpoints.
The technical implementation of this vulnerability stems from insufficient access controls within the eSIM LPA API interface, where the system fails to properly validate user credentials or session tokens before executing privileged operations related to eSIM profile management and provisioning. Attackers exploiting this weakness can initiate unauthorized eSIM activation or modification requests from within the local network, effectively bypassing the intended security boundaries that should protect sensitive telecommunications functions. This represents a significant risk as eSIM profiles contain sensitive subscriber information and can be used to establish unauthorized cellular connections.
The operational impact of this vulnerability extends beyond simple unauthorized access, as it could enable attackers to perform unauthorized eSIM profile installations, modify existing profiles, or potentially establish persistent connectivity through compromised devices. Within the local network context, adversaries can leverage this weakness to gain control over device communication capabilities, potentially leading to data exfiltration, service disruption, or even cellular network infiltration if the compromised devices are part of larger deployments. The localized attack vector reduces detection complexity while simultaneously increasing the potential for lateral movement within network segments containing these devices.
Mitigation strategies should include immediate firmware updates from GL.iNet addressing the authorization bypass in the eSIM LPA API component, network segmentation to isolate affected devices from critical infrastructure, and implementation of network monitoring focused on unusual API access patterns or unauthorized eSIM provisioning attempts. Security teams should also consider disabling unnecessary eSIM functionality when not required, implementing strict access controls for API endpoints, and conducting regular vulnerability assessments targeting telecommunications device management interfaces. The ATT&CK framework suggests monitoring for suspicious API usage patterns and implementing principle of least privilege for all administrative functions within network infrastructure devices, particularly those handling sensitive telecommunications data processing capabilities.