Log in Start free

Vulnerability · Published Aug 3, 2026 · Assigned by VulDB

CVE-2026-18585GL.iNet MT2500 APPS-NAS nas-web.get_file_list heap-based overflow

Medium 4.3

In plain English

A medium-severity heap buffer overflow in BE3600 from GL.iNet. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 44% of all known vulnerabilities).

Severity (CVSS 3.1)4.3Medium
Exploit odds (30 days)0.5%top 56.4% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

A vulnerability was detected in GL.iNet MT3000, MT6000, BE9300, BE3600, MT3600BE, E5800, BE6500, MT5000, X3000, XE3000 and MT2500 up to 20260707. The affected element is the function nas-web.get_file_list of the component APPS-NAS Module. Performing a manipulation results in heap-based buffer overflow. The attack may be initiated remotely. The vendor was contacted early about this disclosure and confirmed the existence of the vulnerability.

Affected products (as reported)

VendorProductVersions
GL.iNet MT3000 20260707
GL.iNet MT6000 20260707
GL.iNet BE9300 20260707
GL.iNet BE3600 20260707
GL.iNet MT3600BE 20260707
GL.iNet E5800 20260707
GL.iNet BE6500 20260707
GL.iNet MT5000 20260707
GL.iNet X3000 20260707
GL.iNet XE3000 20260707
GL.iNet MT2500 20260707

Weakness: CWE-122, CWE-119 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L/E:X/RL:X/RC:R

References