Description (CNA)
A flaw has been found in GL.iNet GL-MT3000 up to 4.4.5. The impacted element is the function logread.set_config of the file /usr/lib/oui-httpd/rpc/logread of the component Logread Lua RPC Plugin. This manipulation of the argument record_size causes command injection. The exploit has been published and may be used. The vendor was contacted early about this disclosure and confirmed the existence of the vulnerability.
Affected (CNA)
| Vendor / product | Versions |
|---|---|
| GL.iNet / GL-MT3000 | affected 4.4.0; affected 4.4.1; affected 4.4.2; affected 4.4.3; affected 4.4.4; affected 4.4.5 |
CWE
CWE-77, CWE-74
References
- https://vuldb.com/vuln/385514
- https://vuldb.com/vuln/385514/cti
- https://vuldb.com/cve/CVE-2026-18599
- https://vuldb.com/submit/851536
- https://github.com/StrTzz123/iot_vul/blob/main/GL-iNet/MT3000/4.4.5/logread_set_config_rpc_rce/CVE.md
ADP enrichment
No English description supplied.
No references supplied.