CVE-2026-18585
Medium
Description
A vulnerability was detected in GL.iNet MT3000, MT6000, BE9300, BE3600, MT3600BE, E5800, BE6500, MT5000, X3000, XE3000 and MT2500 up to 20260707. The affected element is the function nas-web.get_file_list of the component APPS-NAS Module. Performing a manipulation results in heap-based buffer overflow. The attack may be initiated remotely. The vendor was contacted early about this disclosure and confirmed the existence of the vulnerability.
SeverityMedium
CVSS4.3
Exploit probability—
ProductGl.inet Mt3000
PublishedAug 3, 2026
First seenAug 3, 2026
Weakness typeCWE-122CWE-122CWE-119Memory buffer bounds error
How to fix
Sources list no fixed version or patch link for this vulnerability.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| gl.inet mt3000 | 20260707 | — |
| gl.inet mt6000 | 20260707 | — |
| gl.inet be9300 | 20260707 | — |
| gl.inet be3600 | 20260707 | — |
| gl.inet mt3600be | 20260707 | — |
| gl.inet e5800 | 20260707 | — |
| gl.inet be6500 | 20260707 | — |
| gl.inet mt5000 | 20260707 | — |
| gl.inet x3000 | 20260707 | — |
| gl.inet xe3000 | 20260707 | — |
| gl.inet mt2500 | 20260707 | — |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.