CVE-2026-18584 PUBLISHED

GL.iNet E5800/E750/X2000/X3000/XE3000/XE300 eSIM LPA API v1 improper authorization

Assigner: VulDB
Reserved: 02.08.2026 Published: 03.08.2026 Updated: 03.08.2026

A security vulnerability has been detected in GL.iNet E5800, E750, X2000, X3000, XE3000 and XE300 up to 20260707. Impacted is an unknown function of the file /sdk/v1 of the component eSIM LPA API. Such manipulation leads to improper authorization. The attack can only be initiated within the local network. The vendor was contacted early about this disclosure and confirmed the existence of the vulnerability.

Metrics

CVSS Vector: CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:X
CVSS Score: 5.3

Product Status

Vendor GL.iNet
Product E5800
Versions
  • Version 20260707 is affected
Vendor GL.iNet
Product E750
Versions
  • Version 20260707 is affected
Vendor GL.iNet
Product X2000
Versions
  • Version 20260707 is affected
Vendor GL.iNet
Product X3000
Versions
  • Version 20260707 is affected
Vendor GL.iNet
Product XE3000
Versions
  • Version 20260707 is affected
Vendor GL.iNet
Product XE300
Versions
  • Version 20260707 is affected

Credits

  • GLiNet (VulDB User) reporter
  • VulDB CNA Team coordinator

References

Problem Types

  • Improper Authorization CWE
  • Incorrect Privilege Assignment CWE