CVE-2026-18600
HighCVSS 8.8Exploitation Probability (EPSS)
High risk79th percentile - higher than 79% of all known CVEs
Summary
A vulnerability has been found in GL.iNet GL-MT3000 up to 4.4.5. This affects the function network.switch_info/network.switch_status of the file /usr/lib/oui-httpd/rpc/network of the component Network Lua RPC Plugin. Such manipulation of the argument switch leads to command injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.
Risk Assessment
The organization is at risk of remote arbitrary command execution on the GL.iNet device, potentially leading to compromise of the router and network.
Recommendation
Immediately upgrade the GL.iNet GL-MT3000 firmware to a version above 4.4.5 that includes a fix.
Other vulnerabilities in GL.iNet GL-MT3000
See all- CVE-2026-18686Critical
A vulnerability was detected in GL.iNet GL-MT3000 up to version 4.4.5. It affects the nas-web.add_user function in the /cgi-bin/glc file of the nas-web RPC Wrapper component. Manipulation leads to command injection, and the attack can be initiated remotely. The exploit is public and may be used.
- CVE-2026-18685Critical
A security vulnerability has been detected in GL.iNet GL-MT3000 up to version 4.4.5. It affects the set_upgrade function in the /cgi-bin/glc file of the modem.so component. Such manipulation leads to command injection, and the attack can be launched remotely. The exploit has been publicly disclosed and may be used.
- CVE-2026-18684Critical
GL.iNet GL-MT3000 router up to version 4.4.5 contains a command injection vulnerability in the remove_profile function in /cgi-bin/glc of the modem.so component. The attack can be performed remotely, and the exploit is publicly available.
- CVE-2026-18616Critical
GL-iNet GL-MT3000 up to version 4.4.5 has a command injection vulnerability in the server.set_peer function of /cgi-bin/glc in the wg-server.so component. Manipulating the public_key argument allows remote command execution.
- CVE-2026-18615Critical
GL-iNet GL-MT3000 up to version 4.4.5 has a command injection vulnerability in the wg-server.generate_publickey function of /cgi-bin/glc in the wg-server.so component. Manipulating the private_key argument allows remote command execution.
- CVE-2026-18614Critical
GL-iNet GL-MT3000 up to version 4.4.5 has a command injection vulnerability in the s2s.enable_echo_server function of /cgi-bin/glc in the s2s.so component. Manipulating the port argument allows remote command execution.
- CVE-2026-18613Critical
GL-iNet GL-MT3000 up to version 4.4.5 has an injection vulnerability in the plugins.set_config function of /cgi-bin/glc in the plugins.so component. Manipulation leads to remote code execution.
- CVE-2026-18612Critical
GL-iNet GL-MT3000 up to version 4.4.5 has a command injection vulnerability in the plugins.remove_package and plugins.install_package functions of /cgi-bin/glc in the plugins.so component. Manipulation leads to remote command execution.
- CVE-2026-18602Critical
A vulnerability was determined in GL.iNet GL-MT3000 up to 4.4.5. Affected is the function ovpn-client.get_recommend_config of the file /cgi-bin/glc of the component ovpn-client.so Native Plugin. Executing a manipulation of the argument Hostname can lead to command injection. The attack can be executed remotely. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure and confirmed the existence of the vulnerability.
- CVE-2026-18601Critical
A vulnerability was found in GL.iNet GL-MT3000 up to 4.4.5. This impacts the function ovpn-client.check_config of the file /cgi-bin/glc of the component ovpn-client.so Native Plugin. Performing a manipulation of the argument filename results in command injection. Remote exploitation of the attack is possible. The exploit has been made public and could be used. The vendor was contacted early about this disclosure and confirmed the existence of the vulnerability.
Original NVD description (English source)
A vulnerability has been found in GL.iNet GL-MT3000 up to 4.4.5. This affects the function network.switch_info/network.switch_status of the file /usr/lib/oui-httpd/rpc/network of the component Network Lua RPC Plugin. Such manipulation of the argument switch leads to command injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure and confirmed the existence of the vulnerability.