AX1800 - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/products/ax1800/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioTue, 04 Aug 2026 17:25:31 +0000Command Injection Vulnerability in GL.iNet AX1800 RPC Endpointhttps://feed.craftedsignal.io/briefs/2026-08-glinet-rce/Tue, 04 Aug 2026 17:25:31 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-08-glinet-rce/An authenticated remote command injection vulnerability in the RPC component of GL.iNet AX1800 routers (firmware <= 4.8.3) allows attackers to execute arbitrary system commands via the 'remove_rule' function.A command injection vulnerability (CVE-2026-18787) has been identified in GL.iNet AX1800 routers running firmware versions up to 4.8.3. The flaw exists within the RPC endpoint component, specifically in the remove_rule function defined in /usr/share/gl-ngx/oui-rpc.lua. Attackers can leverage improper neutralization of the args.id argument to inject and execute arbitrary system commands. This vulnerability is remotely exploitable by an authenticated user. Given that public exploit code is available for this vulnerability, defenders should prioritize patching affected devices to the latest available firmware version to mitigate the risk of unauthorized system access and full device compromise.

Attack Chain

  1. Attacker establishes an authenticated session with the GL.iNet router web management interface or RPC API.
  2. Attacker crafts a malicious request targeting the RPC endpoint.
  3. Attacker injects shell metacharacters into the args.id parameter of the remove_rule RPC call.
  4. The router's /usr/share/gl-ngx/oui-rpc.lua script processes the args.id argument without sufficient input sanitization.
  5. The underlying system passes the unsanitized input to a command execution function, resulting in OS command execution with the privileges of the RPC service.
  6. Attacker gains persistent code execution on the router, potentially allowing for lateral movement or traffic interception.

Impact

Successful exploitation allows for complete compromise of the affected GL.iNet AX1800 router. Impact includes full control over the device, potential exfiltration of network traffic, and use of the router as a pivot point for further attacks on the internal network.

Recommendation

  • Apply the latest firmware updates provided by GL.iNet for the AX1800 to remediate CVE-2026-18787.
  • Restrict access to the router's management interface and RPC endpoints to trusted IP addresses only.
  • Monitor for suspicious RPC calls to the management interface that deviate from established administrative baseline behavior.
]]>highadvisory