A command injection vulnerability (CVE-2026-18599) affects GL.iNet GL-MT3000 devices running firmware versions 4.4.0 to 4.4.5. The vulnerability resides in the logread.set_config function within the Logread Lua RPC Plugin (/usr/lib/oui-httpd/rpc/logread). Manipulating the record_size argument allows an attacker with local or adjacent network access and low privileges to execute arbitrary commands due to insufficient input validation. The vulnerability has been publicly disclosed with proof-of-concept exploit code available. The vendor acknowledged the vulnerability but has not provided an official fix or mitigation at this time.

Successful exploitation allows an attacker with low privileges and no user interaction to execute arbitrary commands on the affected device, potentially leading to full compromise of the router. The vulnerability is remotely exploitable by an attacker on the same network (adjacent network attack vector). The high CVSS score (8.6) reflects the significant risk of command execution with high impact on confidentiality, integrity, and availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict access to the device's management interfaces to trusted users only and monitor for suspicious activity. Avoid exposing the device's RPC interfaces to untrusted networks. Follow vendor communications for updates on patches or official mitigations.