EUVD-2026-52797
GHSA-vfp6-456q-5pqw
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-reachable RPC endpoint requires low-privilege auth (PR:L); no scope change as impact is contained to the router's own OS.
Primary rating from Vendor (VulDB).
CVSS VectorVendor: VulDB
Lifecycle Timeline
3DescriptionCVE.org
A vulnerability was identified in GL.iNet AX1800 up to 4.8.3. The affected element is the function remove_rule of the file /usr/share/gl-ngx/oui-rpc.lua of the component RPC Endpoint. The manipulation of the argument args.id leads to command injection. The attack is possible to be carried out remotely. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure.
AnalysisAI
Command injection in GL.iNet AX1800 router firmware up to version 4.8.3 allows a low-privileged authenticated remote attacker to execute arbitrary OS commands via the remove_rule RPC endpoint. The vulnerable parameter args.id in /usr/share/gl-ngx/oui-rpc.lua is passed unsanitized to a shell command, enabling full device takeover. No public KEV listing exists, but a proof-of-concept exploit is publicly available on GitHub, meaningfully lowering the barrier to exploitation.
Technical ContextAI
The GL.iNet AX1800 is a Wi-Fi 6 consumer and SMB router running an OpenWrt-based firmware stack with an nginx web management interface (gl-ngx). The affected component is the Lua-based RPC layer (oui-rpc.lua) that handles administrative operations including firewall rule management. The remove_rule function incorporates the caller-supplied args.id value directly into a shell invocation without sanitization, a textbook CWE-77 (Command Injection) defect. The CPE cpe:2.3:a:gl.inet:ax1800:*:*:*:*:*:*:*:* indicates all tracked versions of the AX1800 application firmware are affected through 4.8.3. Because the RPC endpoint is served over the network by nginx, the attack surface is reachable to any host that can reach the management interface.
RemediationAI
No vendor-released patch has been identified at time of analysis for GL.iNet AX1800. As immediate compensating controls: restrict access to the router management interface (typically TCP 80/443 and associated RPC ports) to known, trusted IP addresses using upstream ACLs or host firewall rules, accepting the trade-off of reduced remote manageability. Disable WAN-side remote management if currently enabled, as this is likely non-default and would restrict exploitation to LAN-adjacent attackers. Enforce strong, unique administrative credentials to raise the cost of the required low-privilege authentication step. Monitor https://vuldb.com/vuln/385788 and GL.iNet's official firmware release channel for a patched build; upgrade immediately upon availability given the public POC. Disabling the remove_rule RPC function directly would break web-UI-based firewall rule deletion and is only viable if that capability is not operationally required.
OS command injection in GL.iNet firmware 4.8.x exposes eight router models to unauthenticated remote root code execution
Authorization bypass in the WebDAV Service COPY/MOVE operations on seventeen GL.iNet router models running firmware up t
OS command injection in GL.iNet routers running firmware up to 4.8.x allows an authenticated remote attacker to execute
Code injection in GL.iNet router firmware's Language Auto-Update component allows low-privileged authenticated remote at
Hard-coded cryptographic key exposure in the glnassys (GL.iNet NAS system) component across eight GL.iNet router models
Same weakness CWE-77 – Command Injection
View allSame technique Command Injection
View allShare
External POC / Exploit Code
Leaving vuln.today