GL.iNet Routers CVE-2026-18584

Q: What is the CVSS score of CVE-2026-18584?

CVE-2026-18584 has a CVSS 4.0 base score of 5.3 (Medium). CVSS vector: CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.2%.

EUVD-2026-52153 MEDIUM

Improper Authorization (CWE-285)

2026-08-03 VulDB

GHSA-ww63-fp7c-4c6q

Authentication Bypass E5800 E750 X2000 X3000 Xe3000 Xe300

5.3

CVSS 4.0 · Vendor: VulDB

Severity by source

Vendor (VulDB) PRIMARY

5.3 MEDIUM

CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

5.4 MEDIUM

Adjacent-only attack vector; no auth required per nginx bypass; only low integrity and availability impact on eSIM config; no confidentiality exposure.

3.1 AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L

4.0 AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N

Primary rating from Vendor (VulDB).

CVSS VectorVendor: VulDB

Attack Vector

Adjacent

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Aug 03, 2026 - 05:52 vuln.today

DescriptionCVE.org

A security vulnerability has been detected in GL.iNet E5800, E750, X2000, X3000, XE3000 and XE300 up to 20260707. Impacted is an unknown function of the file /sdk/v1 of the component eSIM LPA API. Such manipulation leads to improper authorization. The attack can only be initiated within the local network. The vendor was contacted early about this disclosure and confirmed the existence of the vulnerability.

AnalysisAI

Improper authorization in GL.iNet's eSIM LPA API allows adjacent-network unauthenticated attackers to bypass nginx proxy controls on six cellular router models, gaining unauthorized access to eSIM management functions. Affected devices include the E5800, E750, X2000, X3000, XE3000, and XE300 running firmware up to 20260707. The GitHub advisory title explicitly frames this as 'Unauthenticated access to eSIM LPA API via nginx proxy bypass,' indicating the authorization enforcement failure lies in how nginx proxies requests to the /sdk/v1 endpoint. No public exploit code or CISA KEV listing has been identified at time of analysis.

Technical ContextAI

GL.iNet produces portable and travel-oriented cellular routers that include embedded eSIM (electronic SIM) support managed via a Local Profile Assistant (LPA) API exposed at /sdk/v1. The LPA handles eSIM profile provisioning, activation, and management - operations that should be restricted to authenticated local administrators. Based on the GitHub advisory title, the device's nginx reverse proxy fails to enforce access controls on this API path, likely due to a misconfigured location block or missing authentication directive in the proxy layer. CWE-285 (Improper Authorization) confirms the root cause is not missing authentication per se but a failure to correctly verify whether a requestor is authorized to invoke the eSIM management interface. Affected CPE strings (cpe:2.3:a:gl.inet:e5800, e750, x2000, x3000, xe3000, xe300) confirm the issue spans GL.iNet's entire eSIM-capable router lineup through firmware dated 20260707.

RemediationAI

The primary remediation is to apply a firmware update from GL.iNet once a patched release is available - check https://www.gl-inet.com/firmware/ and the GL.iNet CVE issues tracker at https://github.com/gl-inet/CVE-issues for release announcements, as no specific fixed firmware version number appears in the available data. In the interim, compensating controls should focus on restricting network-layer access to the /sdk/v1 endpoint: configure the device's firewall rules to block access to the eSIM LPA API path from untrusted WLAN clients (guest network isolation), or disable the guest/public Wi-Fi interface entirely if eSIM management is not needed by network users. Operators deploying these devices in shared-network environments (hotspots, mobile offices) should additionally enforce client isolation so associated Wi-Fi clients cannot reach the device's management interfaces. Note that client isolation may break device-to-device communication flows that some users depend on.