CVE-2026-18599 in GL-MT3000
Summary
by MITRE • 08/03/2026
A flaw has been found in GL.iNet GL-MT3000 up to 4.4.5. The impacted element is the function logread.set_config of the file /usr/lib/oui-httpd/rpc/logread of the component Logread Lua RPC Plugin. This manipulation of the argument record_size causes command injection. The exploit has been published and may be used. The vendor was contacted early about this disclosure and confirmed the existence of the vulnerability.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 08/03/2026
The vulnerability identified in GL.iNet GL-MT3000 devices running firmware versions up to 4.4.5 represents a critical command injection flaw within the Logread Lua RPC Plugin component. This vulnerability specifically affects the logread.set_config function located in the /usr/lib/oui-httpd/rpc/logread file, which serves as a remote procedure call interface for system logging operations. The flaw stems from inadequate input validation and sanitization within the record_size parameter handling mechanism, creating an exploitable path where maliciously crafted input can be interpreted and executed as system commands by the underlying operating system.
The technical implementation of this vulnerability aligns with CWE-77 and CWE-94 categories, representing command injection and improper input sanitization respectively. When an attacker manipulates the record_size argument through the RPC interface, the system fails to properly validate or escape the input before incorporating it into system execution contexts. This allows attackers to inject arbitrary shell commands that execute with the privileges of the affected service, typically root or administrative level access within the device's operating environment. The ATT&CK framework categorizes this as a command and scripting interpreter technique under T1059, where adversaries leverage legitimate system tools to execute malicious code.
The operational impact of this vulnerability extends beyond simple unauthorized command execution, potentially enabling full device compromise and persistent access for attackers. Given that the exploit has been published and is actively available, the risk exposure is immediate and significant for affected deployments. The vulnerability affects network infrastructure devices that serve as gateways or routing points within corporate and residential networks, making them attractive targets for lateral movement and broader network infiltration activities. The GL-MT3000 device typically operates in environments where it handles sensitive network traffic and may be used to bridge different security zones.
The vendor's early confirmation of the vulnerability demonstrates awareness of the security risk but also highlights the delay between discovery and patch availability that leaves devices exposed during critical periods. Organizations utilizing these devices should immediately implement network segmentation measures and monitor for suspicious activity patterns that might indicate exploitation attempts. The RPC interface provides an accessible attack surface that requires careful network access controls and monitoring to prevent unauthorized access. Mitigation strategies include disabling unnecessary RPC services, implementing strict input validation at the network perimeter, and deploying intrusion detection systems capable of identifying command injection patterns in HTTP traffic.
Recommendations for remediation encompass both immediate defensive measures and long-term architectural improvements. Immediate actions should focus on network isolation of affected devices, implementation of web application firewalls to filter RPC requests, and monitoring for exploitation attempts through log analysis. The device firmware should be updated as soon as vendor patches become available, with proper change management processes ensuring that updates are deployed without disrupting critical network operations. Additionally, organizations should conduct comprehensive vulnerability assessments across their entire device inventory to identify similar issues in other network infrastructure components that may utilize similar RPC or logging mechanisms, thereby preventing cascading security failures throughout their network ecosystem.