GL.iNet Routers CVE-2026-18585

Exploitation requires a valid authenticated session on the GL.iNet router with access to the APPS-NAS module (PR:L per the CVSS 4.0 vector). The attacker must hold low-privilege credentials on the device - this is confirmed by both the CVSS vector and the vendor's advisory title which explicitly labels the impact 'authenticated denial of service.' The APPS-NAS module must be enabled and active on the device, as the vulnerable nas-web.get_file_list function is specific to that component. Affected firmware must be version 20260707 or earlier. Exploitation is bounded to denial of service - no confidentiality or integrity impact has been confirmed by the vendor or reflected in the CVSS impact metrics. Internet-facing exploitation without prior credential acquisition is not possible given the PR:L requirement.

The CVSS 4.0 score of 5.3 reflects a moderate, bounded risk: the impact is limited to VA:L (low availability - service disruption rather than full device compromise), with VC:N and VI:N confirming no data leakage or integrity impact. The PR:L requirement is a meaningful gate - only users who already hold authenticated sessions on the router can trigger the flaw, excluding unauthenticated internet-facing exploitation. Attack complexity is low (AC:L), meaning no special race condition or configuration alignment is needed beyond valid credentials. No EPSS data was provided, leaving exploitation probability unquantifiable from this dataset. The vulnerability is absent from CISA KEV and no public POC has been identified, both consistent with the vendor-confirmed-but-not-yet-weaponized posture common in responsible disclosure cases. GL.iNet devices are niche travel and SMB routers rather than mass-deployed enterprise infrastructure, which further limits aggregate exposure. The theoretical heap overflow class (CWE-122) can sometimes enable code execution, but the vendor-confirmed impact is DoS only, and the CVSS impact metrics corroborate this - treat RCE potential as unconfirmed unless further research contradicts the vendor's assessment.

An attacker who possesses a low-privilege account on a GL.iNet router with the APPS-NAS module active sends a specially crafted HTTP request to the nas-web.get_file_list endpoint - for example, a malformed directory path or oversized filename parameter - that exceeds the bounds of the heap-allocated buffer in the function. The resulting memory corruption causes the NAS service or the device itself to crash, rendering the router's NAS functionality unavailable until it is rebooted. No public proof-of-concept exists at time of analysis, but the low attack complexity rating suggests the overflow boundary may be straightforward to locate through fuzzing once credentials are obtained.