CVE-2026-18787
HighCVSS 8.8Exploitation Probability (EPSS)
High risk88th percentile - higher than 88% of all known CVEs
Summary
A command injection vulnerability was identified in GL.iNet AX1800 up to 4.8.3 in the remove_rule function of /usr/share/gl-ngx/oui-rpc.lua (RPC Endpoint component). Manipulation of the args.id argument allows remote command execution. The exploit is publicly available.
Risk Assessment
An attacker can remotely execute arbitrary commands on the router, potentially leading to full device and network compromise.
Recommendation
Update the router firmware to the latest version if available. Restrict access to the RPC interface and monitor network traffic.
Other vulnerabilities in GL.iNet AX1800
See all- CVE-2025-67091Medium
In GL.iNet AX1800 versions 4.6.4 and 4.6.8, the opkg-call script at /usr/libexec/opkg-call is executed with root privileges when triggered via the LuCI web interface or authenticated API calls for package management. The vulnerable code uses shell redirection to create a lock file in the world-writable /tmp directory.
- CVE-2025-67090Medium
The LuCI web interface on GL.Inet AX1800 Version 4.6.4 & 4.6.8 is vulnerable. It lacks rate limiting or account lockout mechanisms on the authentication endpoint (/cgi-bin/luci), allowing an unauthenticated attacker on the local network to perform unlimited password attempts against the admin interface. Fix available in version 4.8.2.
Original NVD description (English source)
A vulnerability was identified in GL.iNet AX1800 up to 4.8.3. The affected element is the function remove_rule of the file /usr/share/gl-ngx/oui-rpc.lua of the component RPC Endpoint. The manipulation of the argument args.id leads to command injection. The attack is possible to be carried out remotely. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS