Medium severity · published Aug 3, 2026
CVE-2026-18585
GL.iNet MT2500 APPS-NAS nas-web.get_file_list heap-based overflow
4.3
CVSS
0.5%
EPSS
No
On KEV
Description
A vulnerability was detected in GL.iNet MT3000, MT6000, BE9300, BE3600, MT3600BE, E5800, BE6500, MT5000, X3000, XE3000 and MT2500 up to 20260707. The affected element is the function nas-web.get_file_list of the component APPS-NAS Module. Performing a manipulation results in heap-based buffer overflow. The attack may be initiated remotely. The vendor was contacted early about this disclosure and confirmed the existence of the vulnerability.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
None
Integrity
None
Availability
Low
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.5% · higher than 43% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
BE
BE3600 · GL.iNet
20260707 · source: vendor
BE
BE6500 · GL.iNet
20260707 · source: vendor
BE
BE9300 · GL.iNet
20260707 · source: vendor
E5
E5800 · GL.iNet
20260707 · source: vendor
MT
MT2500 · GL.iNet
20260707 · source: vendor
MT
MT3000 · GL.iNet
20260707 · source: vendor
MT
MT3600BE · GL.iNet
20260707 · source: vendor
MT
MT5000 · GL.iNet
20260707 · source: vendor
MT
MT6000 · GL.iNet
20260707 · source: vendor
X3
X3000 · GL.iNet
20260707 · source: vendor
XE
XE3000 · GL.iNet
20260707 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-18585
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-18585
github.com
https://github.com/gl-inet/CVE-issues/blob/main/4.0.0/Heap%20buffer%20overflow%20in%20nas-web.get_file_list%20leading%20to%20authenticated%20denial%20of%20service.md
vuldb.com
https://vuldb.com/cve/CVE-2026-18585
vuldb.com
https://vuldb.com/submit/849290
vuldb.com
https://vuldb.com/vuln/385414
vuldb.com
https://vuldb.com/vuln/385414/cti
More from BE3600
8.3
CVE-2026-19979
GL.iNet XE3000 WebDAV Service MOVE authorization
7.4
CVE-2026-19981
GL.iNet XE3000 Wi-Fi Timer Power-Schedule Feature os command injection
7.4
CVE-2026-19980
GL.iNet XE3000 Language Update ui.update_langs code injection