CVE-2026-18585
Received Received - Intake

Heap-based Buffer Overflow in GL.iNet NAS Module

Publication date: 2026-08-03

Last updated on: 2026-08-03

Assigner: VulDB

Description
A vulnerability was detected in GL.iNet MT3000, MT6000, BE9300, BE3600, MT3600BE, E5800, BE6500, MT5000, X3000, XE3000 and MT2500 up to 20260707. The affected element is the function nas-web.get_file_list of the component APPS-NAS Module. Performing a manipulation results in heap-based buffer overflow. The attack may be initiated remotely. The vendor was contacted early about this disclosure and confirmed the existence of the vulnerability.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-03
Last Modified
2026-08-03
Generated
2026-08-03
AI Q&A
2026-08-03
EPSS Evaluated
N/A
NVD
CVE-2026-18585
EUVD
EUVD-2026-52154

Affected Vendors & Products

Showing 11 associated CPEs
Vendor Product Version / Range
gl.inet mt3000 *
gl.inet mt6000 *
gl.inet be9300 *
gl.inet be3600 *
gl.inet mt3600be *
gl.inet e5800 *
gl.inet be6500 *
gl.inet mt5000 *
gl.inet x3000 *
gl.inet xe3000 *
gl.inet mt2500 to 20260707 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-119 The product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary. This may result in read or write operations on unexpected memory locations that could be linked to other variables, data structures, or internal program data.
CWE-122 A heap overflow condition is a buffer overflow, where the buffer that can be overwritten is allocated in the heap portion of memory, generally meaning that the buffer was allocated using a routine such as malloc().

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is a heap-based buffer overflow in GL.iNet devices including models like MT3000 and BE9300. It exists in the nas-web.get_file_list function of the APPS-NAS Module. The flaw allows remote attackers to manipulate inputs, causing memory corruption. The vendor confirmed the issue after early disclosure.

Detection Guidance

This vulnerability affects GL.iNet devices with specific models running up to firmware dated 20260707. Detection requires checking device firmware versions and inspecting network traffic for unusual activity targeting the nas-web.get_file_list function. No specific commands are provided in the available context.

Impact Analysis

An attacker could exploit this to execute arbitrary code, crash the device, or gain unauthorized access. Since the attack is remote, devices exposed to untrusted networks are at risk. This may lead to data theft, device takeover, or disruption of network services.

Compliance Impact

This vulnerability could lead to unauthorized data access or loss, violating GDPR and HIPAA requirements for data protection and confidentiality. Organizations using affected GL.iNet devices may face compliance violations, legal penalties, and reputational damage if exploited.

Mitigation Strategies

Immediately update affected GL.iNet devices to the latest firmware version to patch the heap-based buffer overflow in the APPS-NAS Module. Disable remote access to the nas-web.get_file_list function if possible and monitor network traffic for unusual activity targeting these devices.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-18585. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart