CVE-2026-18599

Name of the Vulnerable Software and Affected Versions GL.iNet GL-MT3000 versions prior to 4.4.6

Description An issue exists in the Logread Lua RPC Plugin within the /usr/lib/oui-httpd/rpc/logread file. Specifically, the logread.set config() function is susceptible to command injection through the manipulation of the record size argument. Command injection is a flaw that allows an attacker to execute arbitrary operating system commands on the affected device.

Recommendations Update GL.iNet GL-MT3000 to version 4.4.6 or later. As a temporary mitigation, restrict access to the logread.set config() function.