CVE-2026-18599: Gl.inet Gl-MT3000

High severity, CVSS 8.0. EPSS: 4.4% chance of exploitation in the next 30 days.

A flaw has been found in GL.iNet GL-MT3000 up to 4.4.5. The impacted element is the function logread.set_config of the file /usr/lib/oui-httpd/rpc/logread of the component Logread Lua RPC Plugin. This manipulation of the argument record_size causes command injection. The exploit has been published and may be used. The vendor was contacted early about this disclosure and confirmed the existence of the vulnerability.

Affected products

• Gl.inet Gl-MT3000: version 4.4.0 only; version 4.4.1 only; version 4.4.2 only; version 4.4.3 only; version 4.4.4 only; version 4.4.5 only

Published 2026-08-03. Last modified 2026-08-12.