HIGH

CVE-2026-18598

2026-08-03 CVSS v3.1

CVSS

8.8

Description

A vulnerability was detected in GL.iNet GL-MT3000 up to 4.4.5. The affected element is the function logread.get_system_log of the file /usr/lib/oui-httpd/rpc/logread of the component Logread Lua RPC plugin. The manipulation of the argument module results in command injection. The attack can be launched remotely. The exploit is now public and may be used. The vendor was contacted early about this disclosure and confirmed the existence of the vulnerability.

Weakness (CWE)

CWE-74 Injection

CWE-77 Command Injection

EPSS Score

1.65%

Probability of exploitation in next 30 days

75.5th percentile

References

https://github.com/StrTzz123/iot_vul/blob/main/GL-iNet/MT3000/4.4.5/logread_get_system_log_rpc_rce/CVE.md https://vuldb.com/cve/CVE-2026-18598 https://vuldb.com/submit/851535 https://vuldb.com/vuln/385513 https://vuldb.com/vuln/385513/cti

View on dbcve.org

Base CVE data derived from NVD (public domain). Enrichment by dbcve.org (CC-BY-4.0). Fetched via API.

Back to CVE