CVE-2026-18598: GL.iNet GL-MT3000 Logread Lua RPC plugin logread logread.get_system_log command injection
A vulnerability was detected in GL.iNet GL-MT3000 up to 4.4.5. The affected element is the function logread.getsystemlog of the file /usr/lib/oui-httpd/rpc/logread of the component Logread Lua RPC plugin. The manipulation of the argument module results in command injection. The attack can be launched remotely. The exploit is now public and may be used. The vendor was contacted early about this disclosure and confirmed the existence of the vulnerability.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-18598?
CVE-2026-18598 has a high severity rating of 8.8.
How do I fix CVE-2026-18598?
To fix CVE-2026-18598, upgrade the GL.iNet GL-MT3000 to version 4.4.6 or later.
What systems are affected by CVE-2026-18598?
CVE-2026-18598 affects GL.iNet GL-MT3000 devices running versions up to 4.4.5.
What type of vulnerability is CVE-2026-18598?
CVE-2026-18598 is a command injection vulnerability.
What is the potential impact of CVE-2026-18598?
Exploitation of CVE-2026-18598 can lead to unauthorized command execution on the affected devices.