Attack Chain

1. Attacker performs network reconnaissance to identify reachable GL.iNet management interfaces.
2. Attacker obtains valid low-privileged credentials for the GL-MT3000 web management portal.
3. Attacker accesses the OUI-based RPC service endpoint used by the Logread Lua RPC plugin.
4. Attacker crafts a malicious HTTP request containing a payload injected into the module argument of the logread.get_system_log function.
5. The oui-httpd service processes the request and passes the tainted module argument to the system shell.
6. The system shell executes the attacker-supplied commands with the privileges of the web service process.
7. Attacker achieves remote code execution for persistence, further system exploitation, or network traversal.

Impact

Successful exploitation allows unauthenticated (if PR is bypassed) or low-privileged remote attackers to gain full control over the router. This can lead to complete compromise of the network traffic passing through the device, unauthorized exfiltration of sensitive information, or the potential for lateral movement into the internal network protected by the router.

Recommendation

• Update GL-MT3000 firmware to version 4.4.6 or later immediately to patch CVE-2026-18598.
• Disable remote access to the web management interface on all internet-facing GL.iNet devices.
• Implement strictly limited access control lists (ACLs) for the device management interface.
• Monitor network logs for unusual HTTP POST requests to /rpc/logread or similar paths containing shell metacharacters such as semicolon, pipe, or backticks in query parameters.