CVE-2026-18584CWE-266CWE-285

CVE-2026-18584

Medium · published August 3, 2026

CVSS v3.1
5.4
EPSS
0%
Percentile
27.6
In the wild
Unconfirmed
What it is

A security vulnerability has been detected in GL.iNet E5800, E750, X2000, X3000, XE3000 and XE300 up to 20260707. Impacted is an unknown function of the file /sdk/v1 of the component eSIM LPA API. Such manipulation leads to improper authorization. The attack can only be initiated within the local network. The vendor was contacted early about this disclosure and confirmed the existence of the vulnerability.

The record
Technical detail
CVSS v3.1
5.4 · MEDIUM
Vector
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L
CVSS v4.0
Not supplied
EPSS
0.00352 · 27.6th percentile
Weaknesses
CWE-266 · Incorrect Privilege Assignment; CWE-285 · Improper Authorization
Published
2026-08-03T10:16Z
References (5)
https://github.com/gl-inet/CVE-issues/blob/main/4.0.0/Unauthenticated%20access%20to%20eSIM%20LPA%20API%20via%20nginx%20proxy%20bypass.md · [email protected]https://vuldb.com/cve/CVE-2026-18584 · [email protected]https://vuldb.com/submit/849283 · [email protected]https://vuldb.com/vuln/385413 · [email protected]https://vuldb.com/vuln/385413/cti · [email protected]
EPSS history
Timeline
  • 03 AUG 04:45Z
    GL.iNet E5800/E750/X2000/X3000/XE3000/XE300 eSIM LPA API v1 improper authorization
    cvelistv5