GL.iNet GL-MT3000 CVE-2026-18598

The attacker must hold valid credentials for the GL-MT3000 management interface, satisfying the PR:L requirement in the CVSS 4.0 vector - unauthenticated exploitation is not supported by available data. Network access to the device's HTTP/HTTPS management port is required (AV:N); devices with management interfaces exposed to the internet or accessible from untrusted networks are at highest risk. No non-default configuration is required: the Logread Lua RPC plugin appears to be a standard component of GL-MT3000 firmware 4.4.0-4.4.5. Exploitation is limited to authenticated sessions, and devices whose management interfaces are bound exclusively to a trusted LAN segment (with no cloud remote access enabled) significantly reduce reachable attack surface.

The CVSS 4.0 score of 8.7 (AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H) reflects high impact but requires authenticated access (PR:L), which moderates the practical attack surface compared to unauthenticated flaws. The E:P modifier confirms a public PoC exists, raising the likelihood of opportunistic exploitation. EPSS data was not provided, so probability comparison against base score is not possible. The device is not listed in the CISA KEV at time of analysis, so confirmed in-the-wild mass exploitation is not established. Real-world risk is elevated by the prevalence of default or weak credentials on consumer routers: an attacker who brute-forces or reuses leaked credentials trivially clears the PR:L barrier. As a router, a fully compromised device also enables traffic interception and pivoting, consequences not fully captured in the CVSS SC:N/SI:N/SA:N scope metrics. No conflicting signals were detected; the CVSS vector is consistent with the described attack mechanism.

An attacker with valid credentials to the GL-MT3000 web management interface - obtained through credential stuffing, default password use, or network sniffing - sends a crafted HTTP RPC request to the /usr/lib/oui-httpd/rpc/logread endpoint with a malicious module argument containing shell metacharacters. The unsanitized argument is interpolated directly into a shell command, causing arbitrary code to execute on the device, likely as root given OpenWrt conventions. The publicly available PoC on GitHub (StrTzz123/iot_vul) demonstrates the precise request structure needed.