Dashboard / CVE-2026-18599

CVE-2026-18599

HIGH
MEDIUM Priority: 0.32 BB Relevance: 50/100
Published: 2026-08-03 Modified: 2026-10-23 First seen: 2026-10-29 Status: active

Attack Surface

Adjacent Low Complexity No Interaction Conf. Impact Integ. Impact

CVSS Vector Breakdown

AV: Adjacent
AC: Low
PR: Low
UI: None
S: X
AT: None
VC: High
VI: High
VA: High

Description

A flaw has been found in GL.iNet GL-MT3000 up to 4.4.5. The impacted element is the function logread.set_config of the file /usr/lib/oui-httpd/rpc/logread of the component Logread Lua RPC Plugin. This manipulation of the argument record_size causes command injection. The exploit has been published and may be used. The vendor was contacted early about this disclosure and confirmed the existence of the vulnerability.

Weakness Classification (2)

References & Advisories (5)

Bug Bounty Relevance

50 / 100
✓ Low complexity
✓ No user interaction

CVSS Score

7.3 / 10.0 v4.0
CVSS:4.0/AV:A/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

EPSS — Exploitation Probability

4.44%
Raw Score 0.044440
Percentile 91.4%
Date 2026-10-29

EPSS Trend

2026-10-29
0.04444
2026-10-28
0.04444

Intelligence Sources

nvd ref →

External Links