PT-2026-67144 · Gl.Inet · Be3600+10

Glinet · CVE-2026-18585 · Published 2026-08-03 · Updated 2026-08-03

Mitre

CVSS v3.1

4.3

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L

A vulnerability was detected in GL.iNet MT3000, MT6000, BE9300, BE3600, MT3600BE, E5800, BE6500, MT5000, X3000, XE3000 and MT2500 up to 20260707. The affected element is the function nas-web.get file list of the component APPS-NAS Module. Performing a manipulation results in heap-based buffer overflow. The attack may be initiated remotely. The vendor was contacted early about this disclosure and confirmed the existence of the vulnerability.

Exploit

Fix

Buffer Overflow

Heap Based Buffer Overflow

Weakness Enumeration

CWE-119

CWE-122

Related Identifiers

CVE-2026-18585

Affected Products

Be3600

Be6500

Be9300

E5800

Mt2500

Mt3000

Mt3600Be

Mt5000

Mt6000

X3000

Xe3000

References · 6

• 🔥 https://github.com/gl-inet/CVE-issues/blob/main/4.0.0/Heap%20buffer%20overflow%20in%20nas-web.get_file_list%20leading%20to%20authenticated%20denial%20of%20service.md · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-18585 · Security Note
• https://vuldb.com/cve/CVE-2026-18585 · Note
• https://vuldb.com/submit/849290 · Note
• https://vuldb.com/vuln/385414 · Note
• https://vuldb.com/vuln/385414/cti · Note