CVE-2026-18599: GL.iNet GL-MT3000 Logread Lua RPC Plugin logread logread.set_config command injection
A flaw has been found in GL.iNet GL-MT3000 up to 4.4.5. The impacted element is the function logread.setconfig of the file /usr/lib/oui-httpd/rpc/logread of the component Logread Lua RPC Plugin. This manipulation of the argument recordsize causes command injection. The exploit has been published and may be used. The vendor was contacted early about this disclosure and confirmed the existence of the vulnerability.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-18599?
The severity of CVE-2026-18599 is classified as high with a score of 8.
How do I fix CVE-2026-18599?
To fix CVE-2026-18599, update the GL.iNet GL-MT3000 device to version 4.4.6 or later.
What type of vulnerability is CVE-2026-18599?
CVE-2026-18599 is classified as a command injection vulnerability.
What component is affected by CVE-2026-18599?
CVE-2026-18599 affects the Logread Lua RPC Plugin on GL.iNet GL-MT3000 devices.
What can an attacker achieve with CVE-2026-18599?
An attacker can exploit CVE-2026-18599 to execute arbitrary commands on the affected GL.iNet GL-MT3000 device.