CVE-2026-18599 GL.iNet CVE debrief

Who should care

Defenders responsible for managing and securing GL.iNet GL-MT3000 devices should be aware of this vulnerability and take steps to verify and mitigate it. This includes verifying firmware versions, applying patches, monitoring device logs, and restricting access to the Logread Lua RPC Plugin. Additionally, defenders should review their incident response plans and update them to address potential exploitation of this vulnerability. Security teams should also

Why it matters

CVE-2026-18599 is a command injection vulnerability in GL.iNet GL-MT3000 devices running firmware up to version 4.4.5. Defenders should verify firmware versions, apply patches, monitor device logs, and restrict access to the Logread Lua RPC Plugin to mitigate potential risks.

• Potential command injection leading to unauthorized access
• Possible disruption of device functionality
• Need for firmware updates or patches
• Verification of device logs for suspicious activity

Technical summary

The logread.set_config function in the /usr/lib/oui-httpd/rpc/logread file of the Logread Lua RPC Plugin is vulnerable to command injection due to improper handling of the record_size argument. This vulnerability exists in GL.iNet GL-MT3000 devices running firmware up to version 4.4.5. An attacker can exploit this vulnerability by manipulating the record_size argument, potentially leading to command injection. The exploit has been published and may be used. The vendor, GL.iNet, was contacted and confirmed the existence of the vulnerability.

Defensive priority

Defenders should prioritize verifying the firmware version of GL.iNet GL-MT3000 devices and applying patches or updates as soon as they become available.

Recommended defensive actions

• Verify the firmware version of GL.iNet GL-MT3000 devices
• Apply patches or updates as soon as they become available
• Monitor device logs for suspicious activity
• Restrict access to the Logread Lua RPC Plugin
• Perform vulnerability scanning to identify exposed systems
• Implement network segmentation to limit the attack surface
• Review and update incident response plans to address potential exploitation

Evidence notes

The CVE record and NVD entry provide details about the vulnerability, including its existence in GL.iNet GL-MT3000 devices running firmware up to version 4.4.5 and the potential for command injection through the logread.set_config function.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.