GL.iNet Routers CVE-2026-18585

Q: What is the CVSS score of CVE-2026-18585?

CVE-2026-18585 has a CVSS 4.0 base score of 5.3 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.3%.

EUVD-2026-52154 MEDIUM

Heap-based Buffer Overflow (CWE-122)

2026-08-03 VulDB

GHSA-jrxr-jp3v-2pw6

Buffer Overflow Heap Overflow Mt3000 Mt6000 Be9300 Be3600 Mt3600Be E5800 Be6500 Mt5000 X3000 Xe3000 Mt2500

5.3

CVSS 4.0 · Vendor: VulDB

Severity by source

Vendor (VulDB) PRIMARY

5.3 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

4.3 MEDIUM

PR:L required per vendor-confirmed authenticated-only exploitation; impact limited to availability (DoS) with no confidentiality or integrity effect.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N

Primary rating from Vendor (VulDB).

CVSS VectorVendor: VulDB

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Aug 03, 2026 - 05:51 vuln.today

DescriptionCVE.org

A vulnerability was detected in GL.iNet MT3000, MT6000, BE9300, BE3600, MT3600BE, E5800, BE6500, MT5000, X3000, XE3000 and MT2500 up to 20260707. The affected element is the function nas-web.get_file_list of the component APPS-NAS Module. Performing a manipulation results in heap-based buffer overflow. The attack may be initiated remotely. The vendor was contacted early about this disclosure and confirmed the existence of the vulnerability.

AnalysisAI

Heap-based buffer overflow in the GL.iNet APPS-NAS module's nas-web.get_file_list function allows authenticated remote attackers to crash the NAS service on eleven router models running firmware up to 20260707, resulting in a denial of service. The vendor confirmed the vulnerability following responsible disclosure, and the GitHub advisory explicitly identifies the impact as authenticated denial of service with no confidentiality or integrity compromise. No public exploit code has been identified and the vulnerability is not listed in CISA KEV at time of analysis.

Technical ContextAI

The affected function nas-web.get_file_list is part of the APPS-NAS web interface module embedded in GL.iNet router firmware - a component that provides NAS (Network Attached Storage) browsing and file listing capabilities over the router's management interface. CWE-122 (Heap-based Buffer Overflow) identifies the root cause: the function fails to properly validate or bound-check user-supplied input before writing into a heap-allocated buffer, allowing memory beyond the buffer's boundary to be overwritten. The CVSS 4.0 vector AV:N/AC:L/AT:N/PR:L/UI:N confirms the function is reachable over the network with minimal complexity once the attacker holds low-privilege credentials. Affected CPEs span eleven distinct product lines (cpe:2.3:a:gl.inet:mt3000 through xe3000), all sharing the same APPS-NAS codebase in firmware versions dated up to 20260707.

RemediationAI

No specific patched firmware version is confirmed in the available intelligence data; the vendor acknowledged the vulnerability through responsible disclosure but a fixed release has not been independently verified at time of analysis. Monitor GL.iNet's official firmware release channel and the vendor's GitHub CVE issues tracker at https://github.com/gl-inet/CVE-issues/ for a patched build and apply it as soon as one is confirmed. As an immediate compensating control, disable the APPS-NAS module entirely if NAS functionality is not operationally required - this removes the vulnerable code path from the attack surface with no impact on core routing functionality. If NAS must remain enabled, restrict access to the router's management interface to trusted internal IP ranges only, preventing untrusted authenticated users from reaching the nas-web.get_file_list endpoint. Do not expose the router administration interface directly to the internet regardless of this vulnerability, as it unnecessarily widens exposure to this and other management-plane flaws.