Improper Authorization in GL.iNet Devices Affects eSIM LPA API Functionality

CVE-2026-18584

What is CVE-2026-18584?

A security vulnerability has been identified in various GL.iNet router models impacting their eSIM LPA API. An unknown function within the file /sdk/v1 allows for improper authorization, enabling potential attackers to exploit this flaw. This manipulation is restricted to initiation within the local network environment. The vulnerability was disclosed to the vendor prior to public knowledge, who has verified its existence and acknowledged its implications.

References