Executive brief
GL.iNet AX1800 is a wireless router used in home and small-office networks. A remote code execution flaw in its RPC interface allows unauthenticated attackers to execute arbitrary shell commands, potentially compromising the router and any devices connected to it. Exploitation code is publicly available.
Technical details
The vulnerability is a command injection flaw in the remove_rule function of /usr/share/gl-ngx/oui-rpc.lua on the RPC endpoint. The vulnerability stems from insufficient input sanitization on the args.id parameter, which is passed to a shell command without proper escaping. An attacker can send a crafted RPC request with a malicious args.id value to inject and execute arbitrary commands. The attack is network-accessible and requires no authentication. A remote attacker can achieve full device compromise with root privileges.
Affected products
- GL.iNet AX1800 up to 4.8.3
Timeline
- 2026-08-04: disclosed
- other: Exploit publicly available