CVE-2026-18787 is a command injection in GL.iNet AX1800 firmware (version 4.8.3 and possibly earlier), affecting the gl-ngx RPC framework. The vulnerability lives in the remove_rule Lua function, which is exposed as a network-accessible RPC endpoint. This function constructs a shell command using the args.id parameter without sanitization, passing it directly to io.popen() or equivalent. An attacker with RPC access can inject arbitrary shell commands via the id parameter.
What makes this worth your attention: the vulnerability is not an isolated developer mistake. The gl-ngx RPC framework is architected as thin wrappers around existing shell scripts and iptables commands. The framework provides no safe parameterization primitives — no prepared statement equivalents, no input sanitization helpers, no compile-time checks. This design makes shell command string interpolation the path of least resistance across every RPC endpoint. The args.id parameter likely appeared 'safe' to the developer because it was expected to be numeric, but Lua-to-shell parameter pass-through does not automatically escape metacharacters. This assumption failure is predictable when security review is absent and developers rely on intuition about what 'looks' dangerous.
Check your GL.iNet device now: identify all RPC endpoints, audit each one for direct string interpolation of parameters into shell commands, and prioritize patching. But patching alone won't solve this class. The real question is whether gl-ngx has been refactored to provide safe command construction primitives, or whether this endpoint was hardened while others remain vulnerable. If the patch only touches remove_rule, the underlying architecture — which systematically incentivizes dangerous shortcuts — remains unchanged.
The blast radius matters here. A compromised router is a compromised gateway. Attackers who exploit this gain DNS control, DHCP control, and a position on the bridge between your network and the internet. CVSS 8.8 captures individual severity but understates cascade potential.
Finally: monitor your device's firmware support lifecycle. Consumer router firmware patches frequently fail to reach deployed devices. The 2026 date on this CVE means the affected AX1800 may reach end-of-life before many installations are patched, leaving the vulnerable RPC surface active well beyond the disclosure window.