GL.iNet Routers CVE-2026-18584

The attacker must be on the same local network segment (Wi-Fi or LAN) as the affected GL.iNet device - remote internet-based exploitation is not possible given AV:A. No authentication is required (PR:N), and no user interaction is needed. The vulnerability is present only on devices running firmware up to 20260707 and only on models with eSIM capability (E5800, E750, X2000, X3000, XE3000, XE300). The specific enabling condition is the nginx proxy's failure to enforce authorization on the /sdk/v1 path, meaning the eSIM LPA service must be running and reachable through the proxy. Exploitation is limited to integrity and availability impacts on eSIM configuration - no credential theft or confidentiality breach is indicated by the CVSS vector.

The CVSS 4.0 vector (AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:L) limits real-world scope in two important ways: the attack vector is Adjacent (LAN/Wi-Fi), meaning the attacker must already be on the same network segment, and impact is rated Low for both integrity and availability with no confidentiality impact. EPSS data is not provided, and no KEV listing exists, which is consistent with a niche consumer/prosumer device class. However, the authentication bypass via nginx proxy bypass is structurally clean to exploit - low complexity and no privileges required - which elevates concern for deployment scenarios where the device is shared (e.g., travel hotspot in a hotel, co-working space, or shared mobile office). The primary real-world risk is unauthorized eSIM profile manipulation by another user on the same network, potentially disrupting cellular connectivity or modifying billing-impacting configurations. This is a genuine issue for the affected use cases but not a critical enterprise-class threat.

An attacker connected to the same Wi-Fi network as an affected GL.iNet router - for example, a guest user on a shared travel hotspot - sends a crafted HTTP request directly to the /sdk/v1 eSIM LPA API endpoint, bypassing the nginx proxy's authorization check. Because no authentication is enforced at this endpoint, the attacker can invoke eSIM management operations such as profile switching or deletion, potentially disrupting the device owner's cellular connectivity. No public exploit code has been identified, but the low complexity of the nginx proxy bypass class of vulnerabilities means exploitation would be straightforward for a moderately skilled attacker.