GL.iNet AX1800 CVE-2026-18787

Exploitation requires at minimum low-privilege authenticated access to the GL.iNet AX1800 management interface, as confirmed by the CVSS 4.0 PR:L metric - unauthenticated exploitation is not indicated by available data. The attacker must be able to reach the RPC endpoint served by the router's nginx instance; from the LAN this is the default reachable surface, while WAN-side exploitation additionally requires remote management to be explicitly enabled (a non-default configuration on consumer routers). The specific vulnerable code path is the remove_rule function, meaning the firewall rule management feature must be accessible via the RPC endpoint. Exploitation is limited by: the low-privilege authentication prerequisite, and the management interface's typical restriction to LAN-only access in default deployments.

The CVSS 4.0 base score of 7.4 (High) is driven by network accessibility (AV:N), low complexity (AC:L), and high impact across confidentiality, integrity, and availability (VC:H/VI:H/VA:H) with no user interaction required. The PR:L metric is the primary limiting factor - some credential or session access is required, reducing opportunistic mass exploitation. The E:P supplemental metric and the confirmed GitHub POC are consistent and raise urgency: exploitation is not theoretical. No CISA KEV listing means wide in-the-wild exploitation is not confirmed as of this analysis. EPSS data was not provided in available intelligence, so probability-based triage cannot be performed. The real-world risk is concentrated in environments where management interfaces are exposed beyond trusted subnets, or where credentials are weak or shared. For organizations using GL.iNet AX1800 routers with internet-facing or multi-tenant LAN management, this should be treated as a near-term priority given the public POC.

An attacker who has obtained low-privilege credentials to the GL.iNet AX1800 management interface - through credential reuse, default passwords, or LAN-side access - sends a crafted HTTP RPC request to the remove_rule endpoint with shell metacharacters embedded in the args.id parameter. The router's Lua handler passes this value unsanitized to a system shell call, executing the injected command with the privileges of the nginx web process. The public POC on GitHub at https://github.com/xxianxiayubanmian/iot/blob/main/GL-link%20AX1800.md demonstrates this technique, allowing rapid weaponization by low-skill attackers.