Description
A vulnerability was identified in GL.iNet AX1800 up to 4.8.3. The affected element is the function remove_rule of the file /usr/share/gl-ngx/oui-rpc.lua of the component RPC Endpoint. The manipulation of the argument args.id leads to command injection. The attack is possible to be carried out remotely. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure.
Published: 2026-08-04
Score: 8.7 High
EPSS: 1.7% Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

The vulnerability resides in the remove_rule function of the oui-rpc.lua script on GL.iNet AX1800 routers. By manipulating the args.id parameter, an attacker can inject arbitrary shell commands, allowing full remote execution on the device. The weakness is characterized by CWE-74 (Command Injection) and CWE-77 (Improper Handling of Command Construction).

Affected Systems

GL.iNet AX1800 routers running firmware versions up to 4.8.3 are affected. No other vendor or product versions are listed as vulnerable.

Risk and Exploitability

The CVSS score of 8.7 classifies this issue as high severity, and the vulnerability can be exploited remotely via the RPC endpoint. Because the exploit is publicly available and no mitigations from the vendor have been documented in this entry, the attack likelihood is significant. The EPSS score is 2%, and the vulnerability is not currently included in the CISA KEV catalog, but its remote attack vector and high severity suggest that organizations using the affected devices should consider immediate remediation.

Generated by OpenCVE AI on August 5, 2026 at 14:42 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Update the router firmware to the latest version that includes the fix for the remove_rule command injection bug
  • If an immediate firmware upgrade is not possible, block or restrict access to the RPC endpoint by configuring the firewall to allow only trusted IP addresses
  • Implement input validation or sanitization for the id parameter in any custom scripts or configurations to mitigate the injection risk until a vendor patch is applied

Generated by OpenCVE AI on August 5, 2026 at 14:42 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Tue, 04 Aug 2026 18:45:00 +0000

Type Values Removed Values Added
First Time appeared Gl-inet ax1800
Vendors & Products Gl-inet ax1800

Tue, 04 Aug 2026 18:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Tue, 04 Aug 2026 17:15:00 +0000

Type Values Removed Values Added
Description A vulnerability was identified in GL.iNet AX1800 up to 4.8.3. The affected element is the function remove_rule of the file /usr/share/gl-ngx/oui-rpc.lua of the component RPC Endpoint. The manipulation of the argument args.id leads to command injection. The attack is possible to be carried out remotely. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure.
Title GL.iNet AX1800 RPC Endpoint oui-rpc.lua remove_rule command injection
First Time appeared Gl-inet
Gl-inet ax1800 Firmware
Weaknesses CWE-74
CWE-77
CPEs cpe:2.3:o:gl-inet:ax1800_firmware:*:*:*:*:*:*:*:*
Vendors & Products Gl-inet
Gl-inet ax1800 Firmware
References
Metrics cvssV2_0

{'score': 9, 'vector': 'AV:N/AC:L/Au:S/C:C/I:C/A:C/E:POC/RL:ND/RC:UR'}

cvssV3_0

{'score': 8.8, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:X/RC:R'}

cvssV3_1

{'score': 8.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:X/RC:R'}

cvssV4_0

{'score': 8.7, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P'}

Subscriptions

Gl-inet Ax1800 Ax1800 Firmware
cve-icon MITRE

Status: PUBLISHED

Assigner: VulDB

Published:

Updated: 2026-08-04T17:19:14.440Z

Reserved: 2026-08-04T08:33:00.136Z

Link: CVE-2026-18787

cve-icon Vulnrichment

Updated: 2026-08-04T17:19:09.403Z

cve-icon NVD

Status : Deferred

Published: 2026-08-04T17:16:48.817

Modified: 2026-08-12T20:59:00.027

Link: CVE-2026-18787

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-08-05T14:45:16Z

Weaknesses
  • CWE-74

    Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')

  • CWE-77

    Improper Neutralization of Special Elements used in a Command ('Command Injection')