The vulnerability is located in an unknown function of the /sdk/v1 endpoint of the GL.iNet eSIM LPA API. By manipulating requests to this endpoint, a local attacker can bypass the API’s authorization checks and issue commands that are normally restricted to authenticated or privileged users. This flaw allows unauthorized actions such as modifying device settings, provisioning or deprovisioning eSIM profiles, or otherwise gaining privileged control over the device. The weakness is identified as improper authorization (CWE‑285).

All GL.iNet routers carrying the E5800, E750, X2000, X3000, XE3000 and XE300 models are impacted up to firmware release 20260707. Those devices rely on the eSIM LPA API endpoint for remote provisioning tasks, and the flaw affects every instance that has not been patched beyond that release date.

The CVSS base score of 5.3 indicates a medium severity level for this vulnerability. No EPSS score is available, and the flaw is not listed in the CISA KEV catalogue, implying no publicly documented exploitation yet. Because the attack requires local network access, only hosts that can reach the router’s internal interface can potentially exploit the flaw, which limits the threat to environments where the device is connected to an untrusted or poorly segmented local network.