CVE-2026-18598 in GL-MT3000
Summary
by MITRE • 08/03/2026
A vulnerability was detected in GL.iNet GL-MT3000 up to 4.4.5. The affected element is the function logread.get_system_log of the file /usr/lib/oui-httpd/rpc/logread of the component Logread Lua RPC plugin. The manipulation of the argument module results in command injection. The attack can be launched remotely. The exploit is now public and may be used. The vendor was contacted early about this disclosure and confirmed the existence of the vulnerability.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 08/03/2026
The vulnerability identified in GL.iNet GL-MT3000 routers running firmware versions up to 4.4.5 represents a critical command injection flaw within the Logread Lua RPC plugin component. This issue resides in the function logread.get_system_log located at /usr/lib/oui-httpd/rpc/logread, making it accessible through the web interface and remote network connections. The vulnerability stems from improper input validation within the module parameter handling, where user-supplied data is directly incorporated into system command executions without adequate sanitization or escaping mechanisms.
The technical exploitation of this vulnerability occurs when an attacker manipulates the module argument passed to the logread.get_system_log function, enabling arbitrary command execution on the affected device. This remote code execution capability allows attackers to execute arbitrary shell commands with the privileges of the web server process, which typically runs with elevated permissions on the router. The attack vector requires no authentication for exploitation, making it particularly dangerous as it can be leveraged by remote unauthenticated adversaries.
The operational impact of this vulnerability extends beyond simple unauthorized access, as it provides attackers with complete control over the affected router's functionality and potentially the entire network segment it serves. Attackers can leverage this command injection to install malware, modify network configurations, create backdoors, or use the device as a pivot point for further attacks within the local network. The public availability of exploits increases the likelihood of automated attacks and widespread compromise across vulnerable installations.
Security professionals should consider this vulnerability in the context of CWE-78, which specifically addresses improper neutralization of special elements used in OS commands, and aligns with ATT&CK techniques such as T1059 for command and scripting interpreter and T1021 for remote services. The affected component's RPC functionality demonstrates a common pattern where web-based interfaces fail to properly validate or sanitize inputs before passing them to underlying system processes. Organizations should immediately implement network segmentation measures, disable unnecessary remote access, and apply firmware updates from GL.iNet as soon as available to mitigate this risk. Additionally, monitoring network traffic for suspicious command execution patterns and implementing intrusion detection systems can help identify potential exploitation attempts.