Description Summary:
The GL-iNet GL-AR300M16 router contains a command injection vulnerability in the set_config function, allowing for arbitrary command execution.

Executive Summary:
A critical command injection vulnerability in GL-iNet GL-AR300M16 routers allows attackers to execute arbitrary commands and gain full control over the device.

Vulnerability Details

CVE-ID: CVE-2026-26793

Affected Software: GL-iNet GL-AR300M16

Affected Versions: v4.3.11

Vulnerability: The set_config function in the router's firmware fails to properly sanitize user input, leading to a command injection vulnerability. An attacker can provide crafted input to execute arbitrary system commands on the router.

Business Impact

A successful exploit grants the attacker full administrative control over the router. With a CVSS score of 9.8, this allows for persistent network monitoring, traffic redirection, and a foothold for lateral movement within the local network. This is particularly dangerous for remote offices or small businesses relying on these devices for secure connectivity.

Remediation Plan

Immediate Action: Update the GL-iNet firmware to the latest available version that includes a fix for the set_config function.

Proactive Monitoring: Monitor the router for unauthorized configuration changes or unusual outbound traffic that might indicate a compromised device.

Compensating Controls: Disable remote management interfaces and ensure that access to the router's web interface is restricted to trusted local devices only.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of Mar 12, 2026, there is no public information indicating active exploitation of this vulnerability. Command injection flaws in network hardware are frequently targeted by botnets, making this a high-risk entry.

Analyst Recommendation

It is critical to update the firmware on all affected GL-iNet devices immediately. Given the role of routers in network security, a compromise at this level can undermine all other security controls within the environment.

Description Summary:
Multiple GL.iNet router models are susceptible to OS Command Injection due to improper input sanitization in the web management interface.

Executive Summary:
A critical command injection vulnerability in GL.iNet routers allows unauthenticated attackers to execute arbitrary commands with root privileges.

Vulnerability Details

CVE-ID: CVE-2026-19983

Affected Software: GL.iNet A1300, AX1800, AXT1800, MT2500, MT3000, MT6000

Affected Versions: 4.8.*

Vulnerability: The vulnerability involves an OS command injection flaw where the web management interface fails to sanitize input, allowing an unauthenticated attacker to bypass security checks. This can lead to full device compromise via remote command execution.

Business Impact

This vulnerability carries a severe risk as it allows for complete control over the network infrastructure device. With a CVSS score of 8.3, the potential for unauthorized access to the local network, traffic interception, or the use of the router as a pivot point for further attacks makes this a high-priority security concern.

Remediation Plan

Immediate Action: Update the firmware of all affected GL.iNet devices to version 4.9.0 or later immediately.

Proactive Monitoring: Monitor network traffic for unusual outbound connections from the router management interface or unexpected administrative login attempts.

Compensating Controls: Disable remote administrative access to the web interface and isolate management traffic to a secure, internal network segment.

Exploitation Status

Public Exploit Available: Yes, a proof-of-concept is documented in the GL.iNet CVE-issues GitHub repository.

Analyst Notes: As of August 17, 2026, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The presence of a public proof-of-concept significantly lowers the barrier to entry for potential attackers.

Analyst Recommendation

Given the availability of a proof-of-concept and the potential for full system compromise, immediate firmware updates are essential. Network administrators must treat this as a high-urgency task to prevent unauthorized network access and potential exploitation of the router devices.

Description Summary:
A command injection vulnerability in GL.iNet firmware allows authenticated attackers to execute arbitrary system commands via the firewall configuration interface.

Executive Summary:
A high-severity OS command injection vulnerability in GL.iNet firmware allows authenticated attackers to achieve remote code execution.

Vulnerability Details

CVE-ID: CVE-2026-19982

Affected Software: GL.iNet BE9300 and MT6000

Affected Versions: 4.8.*

Vulnerability: This vulnerability involves an OS command injection flaw (CWE-78) triggered by improper input validation within the firewall management functions. Successful exploitation requires the attacker to have low-level authenticated access to the device management interface.

Business Impact

The ability for an attacker to execute arbitrary commands on network infrastructure poses a significant risk to organizational security. This vulnerability could lead to full device compromise, lateral movement into internal segments, or the redirection of network traffic. Given the CVSS score of 7.4, this issue is classified as High severity and requires prompt remediation to prevent unauthorized system control.

Remediation Plan

Immediate Action: Update all affected GL.iNet devices to firmware version 4.9.0 or later to apply the necessary security patches.

Proactive Monitoring: Review device access logs for unusual administrative activity or unexpected system calls originating from the firewall configuration module.

Compensating Controls: Restrict access to the device management interface to trusted administrative IP addresses only, and employ a Web Application Firewall or similar network security appliance to inspect traffic for command injection patterns.

Exploitation Status

Public Exploit Available: Unknown.

Analyst Notes: As of August 18, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The flaw is inherently exploitable by any authenticated user with access to the management console.

Analyst Recommendation

The risk posed by this OS command injection vulnerability is substantial, as it allows for complete control over the network appliance. Administrators should prioritize upgrading firmware to version 4.9.0 across all deployed BE9300 and MT6000 units immediately to neutralize this threat.

Description Summary:
A command injection vulnerability in GL.iNet firmware allows authenticated attackers to execute arbitrary code via the Wi-Fi timer or power schedule cron jobs.

Executive Summary:
An OS command injection vulnerability in multiple GL.iNet router models allows authenticated attackers to execute arbitrary code via scheduling features.

Vulnerability Details

CVE-ID: CVE-2026-19981

Affected Software: GL.iNet A1300, AX1800, AXT1800, BE1400, BE3600, and BE6500

Affected Versions: 4.0 through 4.7

Vulnerability: This vulnerability is an OS command injection flaw (CWE-78) occurring within the cron job handling logic for power and Wi-Fi scheduling. An attacker with low-level authenticated access can manipulate these parameters to execute system-level commands.

Business Impact

Successful exploitation grants an attacker the ability to execute commands with the privileges of the system, potentially resulting in complete device takeover. Because these devices serve as critical network gateways, such a compromise could facilitate man-in-the-middle attacks or internal network reconnaissance. The CVSS score of 7.4 underscores the high risk of this vulnerability to organizational network integrity.

Remediation Plan

Immediate Action: Check the vendor website for the latest firmware updates and apply them as soon as they become available for the specific router model.

Proactive Monitoring: Monitor system logs for unexpected execution of cron tasks or modifications to scheduled power settings.

Compensating Controls: Limit access to the device web interface to authorized personnel and ensure that administrative credentials are complex and unique.

Exploitation Status

Public Exploit Available: Unknown.

Analyst Notes: As of August 18, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The nature of this flaw makes it highly susceptible to exploitation if an attacker gains authenticated access.

Analyst Recommendation

Given the breadth of affected hardware, administrators must perform an inventory of all GL.iNet devices and prepare for firmware deployment. Until patches are applied, restrict management interface access to minimize the window of opportunity for an attacker to authenticate.

Description Summary:
A code injection vulnerability in GL.iNet firmware allows authenticated attackers to execute arbitrary code via the language auto-update cron functionality.

Executive Summary:
A high-severity code injection vulnerability in various GL.iNet routers allows authenticated attackers to gain unauthorized code execution via the auto-update mechanism.

Vulnerability Details

CVE-ID: CVE-2026-19980

Affected Software: GL.iNet A1300, AX1800, AXT1800, BE1400, BE3600, and BE6500

Affected Versions: 4.0 through 4.7

Vulnerability: This vulnerability is a code injection flaw (CWE-94) found within the language auto-update cron process. An attacker with authenticated access can inject malicious commands into the update process, which are then executed by the system.

Business Impact

Exploitation of this vulnerability allows an attacker to execute arbitrary code, which can be leveraged to maintain persistence on the device or exfiltrate sensitive configuration data. The CVSS score of 7.4 reflects the high severity of this issue, as it directly impacts the confidentiality, integrity, and availability of the affected network infrastructure.

Remediation Plan

Immediate Action: Monitor official GL.iNet security advisories and apply firmware updates as soon as they are released for your specific model.

Proactive Monitoring: Review system logs for unusual cron job activity or unexpected processes initiated by the language update service.

Compensating Controls: Disable unnecessary management services and ensure that the administrative interface is not exposed to the public internet.

Exploitation Status

Public Exploit Available: Unknown.

Analyst Notes: As of August 18, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The vulnerability is highly concerning due to its presence in an automated background service.

Analyst Recommendation

Administrators should treat this vulnerability with high urgency. Because it affects multiple models within the GL.iNet ecosystem, a coordinated update strategy is recommended. Ensure that all devices are running the latest firmware to mitigate risks associated with code injection.

Description Summary:
Multiple GL.iNet router models are susceptible to an authorization bypass vulnerability in the WebDAV public-share feature, allowing unauthenticated access to shared resources.

Executive Summary:
An authorization bypass vulnerability in GL.iNet routers allows unauthenticated attackers to access restricted WebDAV public shares, posing a significant risk of unauthorized data exposure.

Vulnerability Details

CVE-ID: CVE-2026-19979

Affected Software: GL.iNet various router models (A1300, AX1800, AXT1800, BE1400, BE3600, BE6500)

Affected Versions: 4.0, 4.1, 4.2, 4.3, 4.4, 4.5, 4.6, 4.7

Vulnerability: The vulnerability involves an improper authorization mechanism within the WebDAV public-share function (CWE-639, CWE-285). This flaw permits unauthenticated network-adjacent or remote attackers to bypass access controls and interact with shared data.

Business Impact

The ability for an unauthenticated user to bypass authorization controls on a network device represents a significant breach of confidentiality and integrity. Given the CVSS score of 8.3, this high-severity vulnerability could lead to the unauthorized retrieval of sensitive files stored on connected storage media or the injection of malicious content into shared directories. Such exposure may result in data loss, regulatory non-compliance, and potential compromise of internal network information.

Remediation Plan

Immediate Action: Disable the WebDAV public-share feature on all affected GL.iNet devices until a security patch is released by the vendor.

Proactive Monitoring: Review system and WebDAV access logs for unauthorized file access attempts or anomalous traffic patterns originating from unknown IP addresses.

Compensating Controls: Implement network-level access control lists or a firewall to restrict access to the WebDAV service to known, trusted internal IP addresses only.

Exploitation Status

Public Exploit Available: Unknown.

Analyst Notes: As of August 17, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The flaw's exploitability is high due to the lack of required authentication for the vulnerable function.

Analyst Recommendation

Given the severity of this authorization bypass, administrators must prioritize the immediate disabling of the vulnerable WebDAV feature. Users should monitor official GL.iNet firmware update channels closely and apply the forthcoming patch as soon as it is made available to fully remediate the underlying logic error.

Description Summary:
A command injection vulnerability in GL.iNet AX1800 allows authenticated users with low privileges to execute arbitrary system commands, potentially leading to full system compromise.

Executive Summary:
A command injection vulnerability in GL.iNet AX1800 devices poses a significant risk of remote code execution for authenticated attackers.

Vulnerability Details

CVE-ID: CVE-2026-18787

Affected Software: GL.iNet AX1800

Affected Versions: 4.8.0, 4.8.1, 4.8.2, 4.8.3

Vulnerability: The device suffers from a command injection flaw (CWE-77). An attacker with low-level authenticated access can manipulate input parameters to execute arbitrary OS commands on the underlying system.

Business Impact

The ability to execute arbitrary commands on a network device can result in complete system takeover, unauthorized access to internal network segments, and potential data interception. Given the CVSS score of 8.8, this vulnerability is categorized as high severity, as it allows an attacker to pivot from the management interface to the broader infrastructure.

Remediation Plan

Immediate Action: Update the GL.iNet AX1800 firmware to a version beyond 4.8.3 as soon as the vendor provides a patch.

Proactive Monitoring: Monitor device logs for unusual command execution patterns or unexpected shell access attempts by low-privileged user accounts.

Compensating Controls: Restrict administrative and low-level access to the device management interface by placing it on a dedicated management VLAN or using firewall rules to limit access to trusted IP addresses.

Exploitation Status

Public Exploit Available: No (no confirmed public weaponized exploit exists in the provided data).

Analyst Notes: As of August 5, 2026, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The presence of a public GitHub repository discussing this flaw increases the likelihood of exploit development.

Analyst Recommendation

The high CVSS score and the existence of a proof-of-concept mandate immediate attention. Organizations should prioritize updating affected hardware and restricting network access to the management interface to prevent unauthorized exploitation.

Description Summary:
A command injection vulnerability in the nas-web component of GL.iNet GL-MT3000 allows remote, unauthenticated attackers to execute arbitrary system commands via the add_user function.

Executive Summary:
A critical command injection vulnerability in GL.iNet GL-MT3000 routers enables remote, unauthenticated attackers to execute arbitrary commands, posing a severe risk of device compromise.

Vulnerability Details

CVE-ID: CVE-2026-18686

Affected Software: GL.iNet GL-MT3000

Affected Versions: 4.4.0, 4.4.1, 4.4.2, 4.4.3, 4.4.4, 4.4.5

Vulnerability: The nas-web RPC wrapper function, specifically add_user, fails to sanitize user inputs, resulting in a command injection vulnerability (CWE-77). This allows unauthenticated remote attackers to execute system-level commands on the router.

Business Impact

An attacker gaining command execution on a router can intercept network traffic, redirect DNS queries, or use the device as a pivot point to attack internal network resources. With a CVSS score of 9.8, this flaw represents a severe threat to network security and data privacy for all users relying on the affected hardware.

Remediation Plan

Immediate Action: Update the firmware of GL-MT3000 devices to the latest available version provided by the vendor.

Proactive Monitoring: Monitor device logs for unusual system activity, unauthorized user creation, or unexpected outbound connections from the router management interface.

Compensating Controls: Restrict access to the router web management interface (nas-web) to trusted internal IP addresses only, and disable remote management features if not required.

Exploitation Status

Public Exploit Available: Yes, a public proof-of-concept exists on GitHub.

Analyst Notes: As of August 3, 2026, there is no public information indicating active exploitation in the wild. However, a public proof-of-concept is available, which significantly lowers the barrier for potential attackers.

Analyst Recommendation

The presence of a public proof-of-concept necessitates an urgent response. All GL-MT3000 devices must be patched immediately to prevent exploitation. If a patch cannot be applied, ensure the device management interface is not exposed to the public internet.

Description Summary:
A command injection vulnerability in the set_upgrade function of the GL.iNet GL-MT3000 modem.so component allows remote, unauthenticated attackers to execute arbitrary system commands.

Executive Summary:
The GL.iNet GL-MT3000 device is vulnerable to remote command injection, posing a critical risk of full system compromise.

Vulnerability Details

CVE-ID: CVE-2026-18685

Affected Software: GL.iNet GL-MT3000

Affected Versions: 4.4.0, 4.4.1, 4.4.2, 4.4.3, 4.4.4, 4.4.5

Vulnerability: The vulnerability exists in the set_upgrade function within the /cgi-bin/glc binary. It allows an unauthenticated remote attacker to inject malicious commands due to improper input validation.

Business Impact

A successful exploit allows an attacker to execute arbitrary commands with the privileges of the web service, leading to full system takeover. Given the CVSS score of 9.8, this vulnerability represents a critical risk that could result in complete loss of device confidentiality, integrity, and availability, potentially facilitating lateral movement within the network.

Remediation Plan

Immediate Action: Update the GL.iNet GL-MT3000 firmware to the latest available version provided by the vendor to remediate the injection flaw.

Proactive Monitoring: Monitor device logs for unusual shell execution patterns or unauthorized requests directed at the /cgi-bin/glc endpoint.

Compensating Controls: Implement strict network access controls or a Web Application Firewall to block unauthorized access to the web interface from untrusted networks until the device is patched.

Exploitation Status

Public Exploit Available: Yes, a public proof-of-concept exists on GitHub.

Analyst Notes: As of August 3, 2026, there is no confirmed active exploitation in the wild; however, a public proof-of-concept repository is available, which significantly lowers the barrier for exploitation. The flaw is inherently dangerous due to the lack of required authentication.

Analyst Recommendation

The severity of this vulnerability, combined with the availability of public exploit code, necessitates immediate action. Administrators should prioritize firmware updates for all affected GL-MT3000 devices to prevent potential remote code execution.

Description Summary:
A command injection vulnerability in the remove_profile function of the GL.iNet GL-MT3000 modem.so component allows remote, unauthenticated attackers to execute arbitrary system commands.

Executive Summary:
The GL.iNet GL-MT3000 device is susceptible to remote command injection, which enables unauthenticated attackers to execute arbitrary code on the system.

Vulnerability Details

CVE-ID: CVE-2026-18684

Affected Software: GL.iNet GL-MT3000

Affected Versions: 4.4.0, 4.4.1, 4.4.2, 4.4.3, 4.4.4, 4.4.5

Vulnerability: The vulnerability originates in the remove_profile function of the /cgi-bin/glc file. It allows an unauthenticated attacker to inject and execute system commands via the web interface.

Business Impact

With a CVSS score of 9.8, this vulnerability is critical. Successful exploitation provides an attacker with complete control over the affected device, potentially allowing them to pivot into internal networks, intercept traffic, or exfiltrate sensitive configuration data.

Remediation Plan

Immediate Action: Apply the latest firmware update provided by GL.iNet to address the command injection vulnerability.

Proactive Monitoring: Review system and access logs for suspicious input strings or anomalous activity originating from the web management interface.

Compensating Controls: Restrict access to the device management interface to trusted IP addresses only, and utilize firewall rules to drop unexpected traffic directed at the /cgi-bin/glc path.

Exploitation Status

Public Exploit Available: Yes, a public proof-of-concept exists on GitHub.

Analyst Notes: As of August 3, 2026, there is no confirmed active exploitation in the wild; however, the availability of a public proof-of-concept makes this a high-priority threat. The vulnerability is highly exploitable due to the lack of required authentication.

Analyst Recommendation

Given the critical nature of this vulnerability and the presence of public exploit material, it is imperative that organizations update their GL.iNet hardware immediately. Failure to patch these devices leaves them open to total compromise by remote actors.

Description Summary:
A command injection vulnerability in the server.set_peer function of the GL-iNet GL-MT3000 wg-server.so plugin allows remote, unauthenticated attackers to execute arbitrary commands.

Executive Summary:
Remote command injection in the GL-iNet GL-MT3000 WireGuard server component exposes the device to unauthorized remote code execution.

Vulnerability Details

CVE-ID: CVE-2026-18616

Affected Software: GL-iNet GL-MT3000

Affected Versions: 4.4.0, 4.4.1, 4.4.2, 4.4.3, 4.4.4, 4.4.5

Vulnerability: The flaw exists in the server.set_peer function within the /cgi-bin/glc file. By manipulating the public_key argument, an unauthenticated remote attacker can trigger command injection.

Business Impact

The CVSS score of 9.8 reflects the severity of this remote code execution vulnerability. Successful exploitation permits full device takeover, which could lead to network-wide compromise, data interception, and total loss of device integrity.

Remediation Plan

Immediate Action: Update the GL-iNet GL-MT3000 device to the latest firmware version. Consult the vendor security advisory for the specific release that addresses this vulnerability.

Proactive Monitoring: Monitor for anomalous traffic or unexpected execution of system commands, particularly those related to WireGuard peer management.

Compensating Controls: Use firewall rules to isolate management interfaces and WireGuard configuration endpoints from the public internet.

Exploitation Status

Public Exploit Available: Yes, a public proof-of-concept exists on GitHub.

Analyst Notes: As of August 3, 2026, there is no confirmed active exploitation in the wild; however, a public proof-of-concept is available for this vulnerability. The lack of authentication requirements makes this an attractive target for remote attackers.

Analyst Recommendation

This vulnerability presents a severe risk to network infrastructure. IT administrators must prioritize updating all affected GL-MT3000 units to the latest firmware version to eliminate the risk of remote code execution.

Description Summary:
An unauthenticated remote command injection vulnerability in the GL-iNet GL-MT3000 allows attackers to execute arbitrary commands via the wg-server.generate_publickey function.

Executive Summary:
A critical command injection flaw in the GL-iNet GL-MT3000 router enables remote, unauthenticated attackers to execute arbitrary system commands.

Vulnerability Details

CVE-ID: CVE-2026-18615

Affected Software: GL-iNet GL-MT3000

Affected Versions: 4.4.0, 4.4.1, 4.4.2, 4.4.3, 4.4.4, 4.4.5

Vulnerability: This vulnerability resides in the wg-server.generate_publickey function within the /cgi-bin/glc interface. An attacker can manipulate the private_key argument to inject and execute arbitrary commands on the underlying operating system.

Business Impact

Exploitation of this vulnerability grants the attacker full administrative control over the affected network device. This facilitates unauthorized access to sensitive internal network traffic, potential credential theft, and total compromise of the network gateway, warranting a critical severity classification based on its 9.8 CVSS score.

Remediation Plan

Immediate Action: Update all GL-MT3000 devices to the latest firmware version released by GL-iNet to patch the vulnerable wg-server.so plugin.

Proactive Monitoring: Monitor firewall logs for unauthorized connection attempts to the router's web management interface and look for anomalous execution of system commands.

Compensating Controls: Disable remote management access on the device until a firmware update can be applied to ensure the device is not reachable from the public internet.

Exploitation Status

Public Exploit Available: Yes — a public proof-of-concept exists on GitHub.

Analyst Notes: As of August 3, 2026, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The vulnerability is highly accessible as it does not require prior authentication.

Analyst Recommendation

Given the critical nature of this vulnerability and the existence of public exploit code, administrators must act immediately to secure their infrastructure. Apply the vendor-provided firmware update as the primary defense and verify device integrity post-update.

Description Summary:
A command injection vulnerability in the s2s.so plugin of the GL-iNet GL-MT3000 allows unauthenticated remote attackers to execute arbitrary commands via the s2s.enable_echo_server function.

Executive Summary:
A critical command injection vulnerability in the GL-iNet GL-MT3000 router allows unauthenticated remote attackers to achieve full system compromise.

Vulnerability Details

CVE-ID: CVE-2026-18614

Affected Software: GL-iNet GL-MT3000

Affected Versions: 4.4.0, 4.4.1, 4.4.2, 4.4.3, 4.4.4, 4.4.5

Vulnerability: The vulnerability exists in the s2s.enable_echo_server function within the /cgi-bin/glc interface. By manipulating the port argument, an unauthenticated attacker can inject and execute arbitrary system commands.

Business Impact

Successful exploitation allows an attacker to gain full control over the router, leading to potential data theft, network interception, or the use of the device as a pivot point for further lateral movement within the internal network. Given the CVSS score of 9.8, this vulnerability represents a maximum severity threat to organizational security and infrastructure integrity.

Remediation Plan

Immediate Action: Identify all GL-MT3000 devices running affected firmware and update them to the latest available version provided by the vendor.

Proactive Monitoring: Review device access logs for suspicious requests directed at /cgi-bin/glc or unusual traffic patterns originating from the router.

Compensating Controls: Deploy a Web Application Firewall or network access control list to restrict access to the device management interface from untrusted or external networks.

Exploitation Status

Public Exploit Available: Yes — a public proof-of-concept exists on GitHub.

Analyst Notes: As of August 3, 2026, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The flaw is inherently dangerous due to its reachability over the network without requiring authentication.

Analyst Recommendation

The severity of this vulnerability, combined with the availability of public proof-of-concept code, necessitates immediate patching. Organizations should prioritize updating all affected GL-iNet devices and restrict administrative access to mitigate the risk of remote code execution.

Description Summary:
A remote injection vulnerability exists in the plugins.set_config function of the GL-iNet GL-MT3000 router firmware, allowing unauthenticated attackers to execute arbitrary code.

Executive Summary:
A critical injection vulnerability in the GL-iNet GL-MT3000 router firmware allows unauthenticated remote attackers to achieve full system compromise.

Vulnerability Details

CVE-ID: CVE-2026-18613

Affected Software: GL-iNet GL-MT3000

Affected Versions: 4.4.0, 4.4.1, 4.4.2, 4.4.3, 4.4.4, 4.4.5

Vulnerability: The flaw resides in the plugins.set_config function within the /cgi-bin/glc file of the plugins.so native plugin. This vulnerability permits unauthenticated remote attackers to inject malicious input, leading to potential full system control.

Business Impact

Successful exploitation of this vulnerability grants an attacker total administrative control over the affected router. This could lead to complete network interception, unauthorized access to internal resources, and significant data exfiltration. Given the CVSS score of 9.8, this risk is classified as critical, as it requires no authentication and can be triggered remotely.

Remediation Plan

Immediate Action: Check the official GL-iNet support portal for firmware updates addressing this vulnerability and apply the latest available version immediately.

Proactive Monitoring: Monitor network traffic for unusual requests directed at the /cgi-bin/glc endpoint and review device access logs for unexpected configuration changes.

Compensating Controls: If a patch is not immediately available, restrict management access to the router interface to trusted internal IP addresses only, and disable remote web administration if not strictly required.

Exploitation Status

Public Exploit Available: Yes, a public proof-of-concept repository exists on GitHub.

Analyst Notes: As of August 3, 2026, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The vulnerability is highly exploitable due to the lack of required authentication.

Analyst Recommendation

Due to the critical nature of this vulnerability and the availability of proof-of-concept code, immediate action is required. Organizations using the GL-MT3000 should verify their firmware version and prioritize the application of vendor patches to prevent potential remote code execution and full device takeover.

Description Summary:
A command injection vulnerability in the plugins.so component of the GL-iNet GL-MT3000 allows unauthenticated remote attackers to execute arbitrary commands via the package management functions.

Executive Summary:
A critical command injection vulnerability in the GL-iNet GL-MT3000 router permits unauthenticated remote attackers to gain full system control.

Vulnerability Details

CVE-ID: CVE-2026-18612

Affected Software: GL-iNet GL-MT3000

Affected Versions: 4.4.0, 4.4.1, 4.4.2, 4.4.3, 4.4.4, 4.4.5

Vulnerability: The flaw exists in the plugins.remove_package and plugins.install_package functions within the /cgi-bin/glc file. Attackers can leverage this to perform command injection, leading to unauthenticated remote code execution.

Business Impact

Successful exploitation poses a severe risk, as it allows attackers to bypass authentication and execute commands with elevated privileges. This can result in complete loss of confidentiality, integrity, and availability for the affected network segment, justifying the 9.8 CVSS score.

Remediation Plan

Immediate Action: Apply the latest firmware update for the GL-MT3000 provided by GL-iNet to resolve the vulnerability in the plugins.so module.

Proactive Monitoring: Inspect system logs for unexpected package management activities or unauthorized command execution events.

Compensating Controls: Restrict access to the web-based management interface by using network segmentation or firewall rules that limit access to trusted internal IP addresses only.

Exploitation Status

Public Exploit Available: Yes — a public proof-of-concept exists on GitHub.

Analyst Notes: As of August 3, 2026, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The vulnerability is highly dangerous due to the ease of invocation via the web interface.

Analyst Recommendation

The presence of exploit code and the critical nature of this vulnerability make it a high priority for remediation. Administrators should verify their device firmware version immediately and apply the necessary patches to protect against potential remote exploitation.

Description Summary:
A command injection vulnerability in the ovpn-client.get_recommend_config function of GL.iNet GL-MT3000 routers allows unauthenticated remote attackers to execute arbitrary system commands.

Executive Summary:
A critical command injection vulnerability in the GL.iNet GL-MT3000 firmware permits unauthenticated remote attackers to execute arbitrary commands with high privileges.

Vulnerability Details

CVE-ID: CVE-2026-18602

Affected Software: GL.iNet GL-MT3000

Affected Versions: 4.4.0, 4.4.1, 4.4.2, 4.4.3, 4.4.4, 4.4.5

Vulnerability: The vulnerability exists in the ovpn-client.get_recommend_config function within the /cgi-bin/glc file. By manipulating the Hostname argument, an unauthenticated remote attacker can trigger command injection, enabling execution of arbitrary commands on the underlying operating system.

Business Impact

The ability to execute arbitrary commands remotely poses a severe threat to business operations. Attackers could gain full control over the router, facilitate lateral movement into the internal network, or deploy persistent malware. With a CVSS score of 9.8, the potential for total system compromise necessitates urgent remediation.

Remediation Plan

Immediate Action: Update the GL.iNet GL-MT3000 firmware to the latest version provided by the vendor to eliminate the command injection vector.

Proactive Monitoring: Review system logs for suspicious process execution and monitor for anomalous outbound traffic from the router that may indicate command-and-control communication.

Compensating Controls: Implement strict firewall rules to block unauthorized access to the web administration interface from external networks until the firmware is updated.

Exploitation Status

Public Exploit Available: Yes, a public proof-of-concept repository exists on GitHub.

Analyst Notes: As of August 3, 2026, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The flaw is inherently dangerous as it allows direct OS command execution without prior authentication.

Analyst Recommendation

This vulnerability represents a critical security risk that can be exploited remotely by unauthenticated attackers. Security teams must ensure all affected GL.iNet devices are updated to the latest available firmware immediately to mitigate the risk of remote command execution and potential network-wide compromise.

Description Summary:
A command injection vulnerability in the GL.iNet GL-MT3000 ovpn-client.so plugin allows unauthenticated remote attackers to execute arbitrary code via the filename argument in /cgi-bin/glc.

Executive Summary:
A critical command injection vulnerability in GL.iNet GL-MT3000 routers allows unauthenticated remote code execution, posing a severe risk to device integrity.

Vulnerability Details

CVE-ID: CVE-2026-18601

Affected Software: GL.iNet GL-MT3000

Affected Versions: 4.4.0, 4.4.1, 4.4.2, 4.4.3, 4.4.4, 4.4.5

Vulnerability: This vulnerability is a command injection flaw (CWE-77) located in the ovpn-client.check_config function. It permits an unauthenticated remote attacker to execute system commands by manipulating the filename argument.

Business Impact

The vulnerability carries a CVSS score of 9.8, reflecting its potential for total system compromise. Successful exploitation grants attackers full control over the router, which can be leveraged to intercept network traffic, pivot into internal networks, or deploy persistent malware, leading to significant data breaches and operational downtime.

Remediation Plan

Immediate Action: Restrict management interface access to trusted networks only and monitor vendor channels for the release of a firmware patch addressing this specific component.

Proactive Monitoring: Review system logs for unusual process execution or modification attempts within the /cgi-bin/ directory.

Compensating Controls: Deploy a Web Application Firewall or network-level access control list to block unauthorized access to the /cgi-bin/glc endpoint.

Exploitation Status

Public Exploit Available: Yes, a public proof-of-concept is available via GitHub.

Analyst Notes: As of Aug 3, 2026, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The flaw is highly accessible as it does not require authentication or user interaction.

Analyst Recommendation

Given the critical severity and the public availability of exploit code, administrators must treat this vulnerability with the highest priority. If a patch is not yet available, implement strict network segmentation to isolate the affected devices from the internet until a secure update can be applied.

Description Summary:
A command injection vulnerability exists in the GL.iNet GL-MT3000 router that allows authenticated users to execute arbitrary system commands via the network switch information RPC interface.

Executive Summary:
A command injection vulnerability in the GL.iNet GL-MT3000 router allows authenticated attackers to achieve remote code execution on affected devices.

Vulnerability Details

CVE-ID: CVE-2026-18600

Affected Software: GL.iNet GL-MT3000

Affected Versions: 4.4.0, 4.4.1, 4.4.2, 4.4.3, 4.4.4, 4.4.5

Vulnerability: This is a command injection vulnerability (CWE-77) triggered via the network switch information RPC. The vulnerability requires the attacker to have low-level authenticated access to the device to execute arbitrary commands.

Business Impact

Successful exploitation of this vulnerability allows an authenticated attacker to execute arbitrary commands with system privileges. This can lead to full device compromise, potential lateral movement within the local network, and the exfiltration of sensitive configuration data. Given the CVSS score of 8.8, this poses a significant risk to network integrity and confidentiality.

Remediation Plan

Immediate Action: Monitor official vendor communication channels for the release of a firmware update and apply it immediately upon availability.

Proactive Monitoring: Review device access logs for suspicious RPC calls or unauthorized attempts to access network configuration parameters.

Compensating Controls: Restrict administrative access to the router interface to trusted IP addresses only and disable remote management features if they are not required for business operations.

Exploitation Status

Public Exploit Available: No (no confirmed weaponized exploit or Metasploit/ExploitDB entry identified).

Analyst Notes: As of August 4, 2026, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The vulnerability is highly exploitable once an attacker gains low-level access to the management interface.

Analyst Recommendation

The severity of this command injection flaw necessitates immediate attention. Administrators should restrict access to the management interface to minimize the attack surface while awaiting a vendor-supplied firmware patch. Once a patch is released, prioritize its deployment to all managed GL-MT3000 units to prevent potential remote code execution.

Description Summary:
A command injection vulnerability in the GL.iNet GL-MT3000 router allows authenticated attackers to execute arbitrary system commands.

Executive Summary:
A command injection vulnerability in the GL.iNet GL-MT3000 router allows an authenticated attacker to gain full control over the affected device.

Vulnerability Details

CVE-ID: CVE-2026-18599

Affected Software: GL.iNet GL-MT3000

Affected Versions: 4.4.0, 4.4.1, 4.4.2, 4.4.3, 4.4.4, 4.4.5

Vulnerability: This vulnerability stems from improper input validation (CWE-77, CWE-74) in the device configuration logic. The attacker must possess low-level privileges (PR:L) on the local network (AV:A) to inject malicious commands into the system.

Business Impact

An attacker who successfully exploits this vulnerability can achieve full system compromise, leading to data exfiltration, interception of network traffic, or the use of the device as a pivot point for further network attacks. The CVSS score of 8.0 confirms a high-risk scenario that threatens the integrity and confidentiality of the entire local network segment.

Remediation Plan

Immediate Action: Update the GL-MT3000 firmware to the latest version provided by the manufacturer. If a patch is not yet available, restrict administrative access to the device.

Proactive Monitoring: Review system logs for unexpected command execution or modifications to configuration files that deviate from established baselines.

Compensating Controls: Disable remote administrative access and ensure that the web management interface is only accessible from trusted, segmented management VLANs.

Exploitation Status

Public Exploit Available: Yes (GitHub PoC repository)

Analyst Notes: As of August 4, 2026, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The presence of a public proof-of-concept increases the likelihood of opportunistic attacks.

Analyst Recommendation

Given the availability of proof-of-concept code and the high potential for total system compromise, users of the GL-MT3000 should treat this as a high-priority update. Ensure that all firmware updates are obtained directly from the vendor to maintain device security.

Description Summary:
A command injection vulnerability exists in the GL.iNet GL-MT3000 router, allowing authenticated users to execute arbitrary commands through the system log retrieval RPC interface.

Executive Summary:
A command injection vulnerability in the GL.iNet GL-MT3000 router allows authenticated attackers to execute arbitrary system commands via the log management interface.

Vulnerability Details

CVE-ID: CVE-2026-18598

Affected Software: GL.iNet GL-MT3000

Affected Versions: 4.4.0, 4.4.1, 4.4.2, 4.4.3, 4.4.4, 4.4.5

Vulnerability: This is a command injection vulnerability (CWE-77) found within the logread system log retrieval RPC. An attacker must possess authenticated access to the device to leverage this flaw for command execution.

Business Impact

Exploitation of this vulnerability grants an authenticated attacker the ability to execute commands on the underlying operating system. This could lead to a total loss of confidentiality and integrity regarding the router's operation, potentially allowing for network traffic interception or total device takeover. The CVSS score of 8.8 reflects the high severity of such an impact on network infrastructure.

Remediation Plan

Immediate Action: Check the GL.iNet support portal for firmware updates and apply the latest version to all affected GL-MT3000 hardware as soon as it is provided.

Proactive Monitoring: Monitor system logs for unusual commands or unexpected spikes in traffic associated with the log retrieval RPC function.

Compensating Controls: Implement network segmentation to limit the exposure of the router management interface and enforce strong password policies for all authenticated users.

Exploitation Status

Public Exploit Available: No (no confirmed weaponized exploit or Metasploit/ExploitDB entry identified).

Analyst Notes: As of August 4, 2026, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The flaw is inherently dangerous due to the potential for arbitrary code execution.

Analyst Recommendation

This vulnerability presents a high risk to the security of the affected GL.iNet devices. Security teams should prioritize patching as soon as the vendor provides a fix. In the interim, ensure that access to the management interface is strictly limited to authorized personnel to mitigate the risk of authenticated exploitation.

Description Summary:
Certain GL.iNet devices running 4.x firmware are vulnerable to authentication bypass, allowing administrative control via specially crafted usernames.

Executive Summary:
A critical authentication bypass vulnerability in GL.iNet 4.x firmware allows unauthenticated attackers to gain full administrative control of the device.

Vulnerability Details

CVE-ID: CVE-2023-46453

Affected Software: GL.iNet GL.iNet firmware 4.x

Affected Versions: 4.3.7 (and other 4.x versions)

Vulnerability: The vulnerability is an authentication bypass flaw triggered by providing a username that is simultaneously a valid SQL statement and a valid regular expression. This grants the attacker full administrative access without prior authentication.

Business Impact

With a CVSS score of 9.8, this flaw is extremely critical as it allows full administrative control over network infrastructure devices. An attacker could intercept traffic, modify network settings, or pivot into the local network, leading to complete compromise of the affected environment.

Remediation Plan

Immediate Action: Check the manufacturer's support portal for the latest firmware release beyond 4.3.7 and apply it immediately.

Proactive Monitoring: Monitor device access logs for unusual login attempts and audit all administrative accounts for unauthorized modifications.

Compensating Controls: Disable remote administrative access (WAN access) to the device's web interface immediately and ensure management is only performed over trusted local segments.

Exploitation Status

Public Exploit Available: Yes — a proof-of-concept is available on GitHub.

Analyst Notes: As of May 8, 2026, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The vulnerability is highly exploitable as it does not require prior authentication.

Analyst Recommendation

Given the ease of exploitation and the potential for total device takeover, this vulnerability represents an urgent risk. Users must verify their firmware version and apply the latest available updates from GL.iNet immediately to secure their network devices.