Heap-Based Buffer Overflow in GL.iNet Router Models
CVE-2026-18585

5.3MEDIUM

Key Information:

Vendor

Gl.inet

Status
Mt3000
Mt6000
Be9300
Be3600
Vendor
CVE Published:
3 August 2026

What is CVE-2026-18585?

A heap-based buffer overflow vulnerability exists in the GL.iNet routers, specifically within the nas-web.get_file_list function of the APPS-NAS Module. This vulnerability allows an attacker to manipulate the system, potentially leading to unauthorized access and denial of service. The flaw can be exploited remotely, making affected models susceptible if proper security measures are not taken. The vendor has been notified about this issue and is confirming its existence.

Affected Version(s)

BE3600 20260707

BE6500 20260707

BE9300 20260707

References

https://vuldb.com/vuln/385414
vdb-entrytechnical-description
https://vuldb.com/vuln/385414/cti
signaturepermissions-required
https://vuldb.com/cve/CVE-2026-18585
third-party-advisory

CVSS V4

Score:
5.3
Severity:
MEDIUM
Confidentiality:
None
Integrity:
None
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

GLiNet (VulDB User)
VulDB CNA Team
.