CVE-2026-18584— GL.iNet E5800/E750/X2000/X3000/XE3000/XE300 eSIM LPA API v1 improper authorization
Possible ATT&CK Techniques 1AI
T1190 · Exploit Public-Facing ApplicationGet alerts for future matching vulnerabilitiesLog in to subscribe
I. Basic Information for CVE-2026-18584
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗ Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
GL.iNet E5800/E750/X2000/X3000/XE3000/XE300 eSIM LPA API v1 improper authorization
Source: CVE Program / CVE List V5
Vulnerability Description
A security vulnerability has been detected in GL.iNet E5800, E750, X2000, X3000, XE3000 and XE300 up to 20260707. Impacted is an unknown function of the file /sdk/v1 of the component eSIM LPA API. Such manipulation leads to improper authorization. The attack can only be initiated within the local network. The vendor was contacted early about this disclosure and confirmed the existence of the vulnerability.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L
Source: CVE Program / CVE List V5
Vulnerability Type
授权机制不恰当
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| GL.iNet | E5800 | 20260707 | cpe:2.3:a:gl.inet:e5800:*:*:*:*:*:*:*:* | |
| GL.iNet | E750 | 20260707 | cpe:2.3:a:gl.inet:e750:*:*:*:*:*:*:*:* | |
| GL.iNet | X2000 | 20260707 | cpe:2.3:a:gl.inet:x2000:*:*:*:*:*:*:*:* | |
| GL.iNet | X3000 | 20260707 | cpe:2.3:a:gl.inet:x3000:*:*:*:*:*:*:*:* | |
| GL.iNet | XE3000 | 20260707 | cpe:2.3:a:gl.inet:xe3000:*:*:*:*:*:*:*:* | |
| GL.iNet | XE300 | 20260707 | cpe:2.3:a:gl.inet:xe300:*:*:*:*:*:*:*:* |
II. Public POCs for CVE-2026-18584
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POCPremium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-18584
请登录查看更多情报信息。
Vendor Advisories for CVE-2026-18584 (1)
Same Patch Batch · GL.iNet · 2026-08-03 · 7 CVEs total
| CVE-2026-18601 | 9.8 CRITICAL | GL.iNet GL-MT3000 ovpn-client.so Native Plugin glc ovpn-client.check_config command inject |
| CVE-2026-18602 | 9.8 CRITICAL | GL.iNet GL-MT3000 ovpn-client.so Native Plugin glc ovpn-client.get_recommend_config comman |
| CVE-2026-18598 | 8.8 HIGH | GL.iNet GL-MT3000 Logread Lua RPC plugin logread logread.get_system_log command injection |
| CVE-2026-18600 | 8.8 HIGH | GL.iNet GL-MT3000 Network Lua RPC Plugin network network.switch_status command injection |
| CVE-2026-18599 | 8.0 HIGH | GL.iNet GL-MT3000 Logread Lua RPC Plugin logread logread.set_config command injection |
| CVE-2026-18585 | 4.3 MEDIUM | GL.iNet MT2500 APPS-NAS nas-web.get_file_list heap-based overflow |
IV. Related Vulnerabilities
Same vendor: GL.iNet
- CVE-2026-18602
GL.iNet GL-MT3000 ovpn-client.so Native Plugin glc ovpn-clie - CVE-2026-18601
GL.iNet GL-MT3000 ovpn-client.so Native Plugin glc ovpn-clie - CVE-2026-18600
GL.iNet GL-MT3000 Network Lua RPC Plugin network network.swi - CVE-2026-18599
GL.iNet GL-MT3000 Logread Lua RPC Plugin logread logread.set - CVE-2026-18598
GL.iNet GL-MT3000 Logread Lua RPC plugin logread logread.get
Same weakness: CWE-285
- CVE-2026-48115
Misskey: Improper Authorization in the Announcements API - CVE-2026-67332
@better-auth/oauth-provider before 1.7.0-beta.4 Authorizatio - CVE-2026-14538
BigQuery Dataset Allowlist Bypass via Metadata Dry-Run in MC - CVE-2026-23981
Apache Superset: Improper Authorization in Chart Update allo - CVE-2026-41187
Calico Tier Authorization Bypass via DeleteCollection
V. Comments for CVE-2026-18584
No comments yet