PT-2026-67144 · Gl.Inet · Be3600+10

Glinet · CVE-2026-18585 · Publicado 2026-08-03 · Atualizado 2026-08-03

Mitre

CVSS v3.1

4.3

Média

Vetor base

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L

A vulnerability was detected in GL.iNet MT3000, MT6000, BE9300, BE3600, MT3600BE, E5800, BE6500, MT5000, X3000, XE3000 and MT2500 up to 20260707. The affected element is the function nas-web.get file list of the component APPS-NAS Module. Performing a manipulation results in heap-based buffer overflow. The attack may be initiated remotely. The vendor was contacted early about this disclosure and confirmed the existence of the vulnerability.

Exploit

Correção

Buffer Overflow

Heap Based Buffer Overflow

Enumeração de Fraquezas

CWE-119

CWE-122

Identificadores relacionados

CVE-2026-18585

Produtos afetados

Be3600

Be6500

Be9300

E5800

Mt2500

Mt3000

Mt3600Be

Mt5000

Mt6000

X3000

Xe3000

Referências · 6

• 🔥 https://github.com/gl-inet/CVE-issues/blob/main/4.0.0/Heap%20buffer%20overflow%20in%20nas-web.get_file_list%20leading%20to%20authenticated%20denial%20of%20service.md · Exploit
• https://vuldb.com/cve/CVE-2026-18585 · Nota
• https://vuldb.com/submit/849290 · Nota
• https://vuldb.com/vuln/385414 · Nota
• https://vuldb.com/vuln/385414/cti · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2026-18585 · Nota de Segurança