This vulnerability in GL.iNet devices arises from improper authorization in an unspecified function of the /sdk/v1 component of the eSIM LPA API. The flaw allows an attacker with local network access to potentially perform unauthorized actions. The affected devices include multiple GL.iNet models up to the 20260707 version. The vendor has acknowledged the issue but has not published a patch or remediation guidance. The CVSS 4.0 base score is 5.3, indicating medium severity, with attack vector limited to adjacent network and no privileges or user interaction required.

The vulnerability allows improper authorization which could enable an attacker on the local network to access or manipulate functions related to the eSIM LPA API without proper permissions. The exact impact is unspecified but could involve unauthorized control or information disclosure within the affected component.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or temporary workaround has been published, users should restrict local network access to trusted parties and monitor vendor communications for updates.