A security vulnerability has been detected in GL.iNet E5800, E750, X2000, X3000, XE3000 and XE300 up to 20260707. Impacted is an unknown function of the file /sdk/v1 of the component eSIM LPA API. Such manipulation leads to improper authorization. The attack can only be initiated within the local network. The vendor was contacted early about this disclosure and confirmed the existence of the vulnerability.

Metrics

Attack Vector Adjacent Network

Attack Complexity Low

Privileges Required None

Attack Requirements None

User Interaction None

Vulnerable System Confidentiality Impact None

Vulnerable System Integrity Impact Low

Vulnerable System Availability Impact Low

Subsequent System Confidentiality Impact None

Subsequent System Integrity Impact None

Subsequent System Availability Impact None

Attack Vector Adjacent Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact None

Integrity Impact Low

Availability Impact Low

User Interaction None

Attack Vector Adjacent Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact None

Integrity Impact Low

Availability Impact Low

User Interaction None

Access Vector Adjacent Network

Access Complexity Low

Authentication None

Confidentiality Impact None

Integrity Impact Partial

Availability Impact Partial

This CVE is not in the KEV list.

Key SSVC decision points have not yet been added.

Affected Vendors & Products

Vendors Products
Gl-inet
  • E5800
  • E750
  • X2000
  • X3000
  • Xe300
  • Xe3000
Gl.inet
  • E5800
  • E750
  • X2000
  • X3000
  • Xe300
  • Xe3000

No data.

No data.

References
Link Providers
https://github.com/gl-inet/CVE-issues/blob/main/4.0.0/Unauthenticated%20access%20to%20eSIM%20LPA%20API%20via%20nginx%20proxy%20bypass.md cve-icon
https://vuldb.com/cve/CVE-2026-18584 cve-icon
https://vuldb.com/submit/849283 cve-icon
https://vuldb.com/vuln/385413 cve-icon
https://vuldb.com/vuln/385413/cti cve-icon
History

Mon, 03 Aug 2026 16:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Mon, 03 Aug 2026 16:15:00 +0000

Type Values Removed Values Added
First Time appeared Gl-inet
Gl-inet e5800
Gl-inet e750
Gl-inet x2000
Gl-inet x3000
Gl-inet xe300
Gl-inet xe3000
Vendors & Products Gl-inet
Gl-inet e5800
Gl-inet e750
Gl-inet x2000
Gl-inet x3000
Gl-inet xe300
Gl-inet xe3000

Mon, 03 Aug 2026 05:30:00 +0000

Type Values Removed Values Added
Description A security vulnerability has been detected in GL.iNet E5800, E750, X2000, X3000, XE3000 and XE300 up to 20260707. Impacted is an unknown function of the file /sdk/v1 of the component eSIM LPA API. Such manipulation leads to improper authorization. The attack can only be initiated within the local network. The vendor was contacted early about this disclosure and confirmed the existence of the vulnerability.
Title GL.iNet E5800/E750/X2000/X3000/XE3000/XE300 eSIM LPA API v1 improper authorization
First Time appeared Gl.inet
Gl.inet e5800
Gl.inet e750
Gl.inet x2000
Gl.inet x3000
Gl.inet xe300
Gl.inet xe3000
Weaknesses CWE-266
CWE-285
CPEs cpe:2.3:a:gl.inet:e5800:*:*:*:*:*:*:*:*
cpe:2.3:a:gl.inet:e750:*:*:*:*:*:*:*:*
cpe:2.3:a:gl.inet:x2000:*:*:*:*:*:*:*:*
cpe:2.3:a:gl.inet:x3000:*:*:*:*:*:*:*:*
cpe:2.3:a:gl.inet:xe3000:*:*:*:*:*:*:*:*
cpe:2.3:a:gl.inet:xe300:*:*:*:*:*:*:*:*
Vendors & Products Gl.inet
Gl.inet e5800
Gl.inet e750
Gl.inet x2000
Gl.inet x3000
Gl.inet xe300
Gl.inet xe3000
References
Metrics cvssV2_0

{'score': 4.8, 'vector': 'AV:A/AC:L/Au:N/C:N/I:P/A:P/E:ND/RL:ND/RC:C'}

cvssV3_0

{'score': 5.4, 'vector': 'CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L/E:X/RL:X/RC:R'}

cvssV3_1

{'score': 5.4, 'vector': 'CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L/E:X/RL:X/RC:R'}

cvssV4_0

{'score': 5.3, 'vector': 'CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:X'}
cve-icon MITRE

Status: PUBLISHED

Assigner: VulDB

Published: 2026-08-03T04:45:07.095Z

Updated: 2026-08-03T15:37:18.296Z

Reserved: 2026-08-02T19:23:56.933Z

Link: CVE-2026-18584

cve-icon Vulnrichment

Updated: 2026-08-03T13:47:50.819Z

cve-icon NVD

No data.

cve-icon Redhat

No data.