GL.iNet GL-MT3000 CVE-2026-18599

Exploitation requires two concrete prerequisites: (1) the attacker must be on the same network segment as the GL-MT3000 - LAN, Wi-Fi (including as a connected wireless client), or bridged VLAN - per the AV:A (Adjacent) CVSS 4.0 metric; and (2) the attacker must hold valid low-privilege credentials to the router's HTTP RPC interface (PR:L), which in GL.iNet's architecture typically means the web administration account. The vulnerable code path is the logread.set_config function within the Logread Lua RPC Plugin at /usr/lib/oui-httpd/rpc/logread, specifically triggered by an unsanitized record_size argument. No non-default configuration is required - the Logread plugin is part of the standard firmware. Exploitation is explicitly bounded: remote internet-based exploitation without prior network adjacency is not possible; unauthenticated exploitation without valid router credentials is not possible per the PR:L vector. The primary limiting factors are the adjacent-only network requirement and the need for credentials.

The CVSS 4.0 base score of 7.3 with threat modifier E:P (proof of concept exists) reflects genuine but bounded risk. The AV:A (Adjacent Network) vector is the dominant limiting factor - exploitation cannot be conducted directly from the internet without first obtaining a foothold on the same LAN or Wi-Fi segment as the device. PR:L further requires valid low-privilege credentials, meaning casual unauthenticated internet-based exploitation is not feasible. That said, the public GitHub proof-of-concept eliminates any exploitation skill barrier for adjacent attackers who possess credentials. No EPSS score was included in the provided intelligence, so probabilistic exploitation likelihood cannot be quantified from this dataset. The vulnerability is not listed in CISA KEV, indicating no confirmed widespread in-the-wild exploitation at time of analysis; however, IoT/router vulnerabilities with public PoCs are historically weaponized quickly in targeted and opportunistic campaigns. The full High C/I/A impact means a successful attacker achieves complete device compromise. Real-world priority should be elevated for environments where GL-MT3000 devices are deployed on shared or semi-trusted network segments (hotel networks, conference environments, co-working spaces) where the adjacent-network assumption is easier to satisfy.

An attacker connected to the same Wi-Fi or LAN segment as a GL-MT3000 running firmware 4.4.0-4.4.5, possessing low-privilege router credentials (e.g., a guest account or stolen admin password), sends a crafted HTTP RPC request to the logread.set_config endpoint with shell metacharacters embedded in the record_size parameter. The Lua plugin passes the unsanitized value directly into an OS command, executing the attacker's payload with the privileges of the oui-httpd process. The publicly available GitHub proof-of-concept provides ready-made payloads, making this trivially reproducible for any attacker satisfying the network adjacency and credential prerequisites.