CVE-2026-18598 is a command injection vulnerability in the GL.iNet GL-MT3000 router series up to version 4.4.5. It affects the logread.get_system_log function within the Logread Lua RPC plugin, specifically due to unsafe manipulation of the 'module' argument. This flaw allows remote attackers with low privileges to execute arbitrary commands on the device. The vulnerability is remotely exploitable without user interaction and impacts confidentiality, integrity, and availability. The vendor has acknowledged the issue but no official patch or remediation details have been provided. Public exploit code exists, increasing the urgency for mitigation.

Successful exploitation allows remote attackers with limited privileges to execute arbitrary commands on affected GL.iNet GL-MT3000 devices, leading to full compromise of confidentiality, integrity, and availability. This can result in unauthorized control over the device and potential network disruption or data theft.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict network access to the affected device's management interfaces to trusted users only and monitor for suspicious activity related to the logread.get_system_log function. Avoid exposing the device management interface to untrusted networks.