CVE-2026-18787
Received Received - Intake

Command Injection in GL.iNet AX1800 Router

Publication date: 2026-08-04

Last updated on: 2026-08-04

Assigner: VulDB

Description
A vulnerability was identified in GL.iNet AX1800 up to 4.8.3. The affected element is the function remove_rule of the file /usr/share/gl-ngx/oui-rpc.lua of the component RPC Endpoint. The manipulation of the argument args.id leads to command injection. The attack is possible to be carried out remotely. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-04
Last Modified
2026-08-04
Generated
2026-08-04
AI Q&A
2026-08-04
EPSS Evaluated
N/A
NVD
CVE-2026-18787
EUVD
EUVD-2026-52797

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
gl.inet ax1800 to 4.8.3 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-77 The product constructs all or part of a command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended command when it is sent to a downstream component.
CWE-74 The product constructs all or part of a command, data structure, or record using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify how it is parsed or interpreted when it is sent to a downstream component.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-18787 is a command injection vulnerability in the GL.iNet AX1800 web management interface up to version 4.8.3. It exists in the RPC Endpoint function remove_rule within the file /usr/share/gl-ngx/oui-rpc.lua. The vulnerability allows an authenticated attacker to inject malicious shell commands via the args.id parameter, which is improperly validated and concatenated into executed commands.

Detection Guidance

To detect this vulnerability, monitor network traffic for POST requests to /rpc with the parental-control.remove_rule method. Check logs for unusual command execution patterns or outbound connections to unknown servers. Use tcpdump or Wireshark to inspect traffic for malicious payloads in args.id parameters.

Impact Analysis

An attacker with authenticated access can execute arbitrary shell commands on the device as the service user, often root. This can lead to full compromise of the device, including data theft, malware installation, or turning the device into a botnet node. The attacker can download and execute malicious scripts from remote servers.

Compliance Impact

This vulnerability can lead to severe compliance violations under GDPR and HIPAA due to unauthorized access and potential data breaches. It compromises confidentiality and integrity of sensitive data processed by the device, which may result in legal penalties, loss of trust, and regulatory fines.

Mitigation Strategies

Immediately update GL.iNet AX1800 firmware to the latest version beyond 4.8.3. Disable the RPC interface if not needed. Restrict network access to the device's web management interface. Monitor for suspicious outbound connections or unauthorized command execution.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-18787. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart