Medium severity · published Aug 3, 2026
CVE-2026-18584
GL.iNet E5800/E750/X2000/X3000/XE3000/XE300 eSIM LPA API v1 improper authorization
5.4
CVSS
0.4%
EPSS
No
On KEV
Description
A security vulnerability has been detected in GL.iNet E5800, E750, X2000, X3000, XE3000 and XE300 up to 20260707. Impacted is an unknown function of the file /sdk/v1 of the component eSIM LPA API. Such manipulation leads to improper authorization. The attack can only be initiated within the local network. The vendor was contacted early about this disclosure and confirmed the existence of the vulnerability.
CVSS vector
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L
Attack vector
Adjacent
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
None
Integrity
Low
Availability
Low
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.4% · higher than 29% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
E5
E5800 · GL.iNet
20260707 · source: vendor
E7
E750 · GL.iNet
20260707 · source: vendor
X2
X2000 · GL.iNet
20260707 · source: vendor
X3
X3000 · GL.iNet
20260707 · source: vendor
XE
XE300 · GL.iNet
20260707 · source: vendor
XE
XE3000 · GL.iNet
20260707 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-18584
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-18584
github.com
https://github.com/gl-inet/CVE-issues/blob/main/4.0.0/Unauthenticated%20access%20to%20eSIM%20LPA%20API%20via%20nginx%20proxy%20bypass.md
vuldb.com
https://vuldb.com/cve/CVE-2026-18584
vuldb.com
https://vuldb.com/submit/849283
vuldb.com
https://vuldb.com/vuln/385413
vuldb.com
https://vuldb.com/vuln/385413/cti
More from E5800
8.3
CVE-2026-19979
GL.iNet XE3000 WebDAV Service MOVE authorization
7.4
CVE-2026-19981
GL.iNet XE3000 Wi-Fi Timer Power-Schedule Feature os command injection
7.4
CVE-2026-19980
GL.iNet XE3000 Language Update ui.update_langs code injection
4.3
CVE-2026-18585
GL.iNet MT2500 APPS-NAS nas-web.get_file_list heap-based overflow