CVE-2026-18601 in GL-MT3000
Summary
by MITRE • 08/03/2026
A vulnerability was found in GL.iNet GL-MT3000 up to 4.4.5. This impacts the function ovpn-client.check_config of the file /cgi-bin/glc of the component ovpn-client.so Native Plugin. Performing a manipulation of the argument filename results in command injection. Remote exploitation of the attack is possible. The exploit has been made public and could be used. The vendor was contacted early about this disclosure and confirmed the existence of the vulnerability.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 08/03/2026
This vulnerability resides within the GL.iNet GL-MT3000 router firmware version 4.4.5 and earlier, specifically targeting the openvpn client functionality exposed through the web interface. The issue manifests in the ovpn-client.check_config function located within the /cgi-bin/glc file, which serves as an entry point for the ovpn-client.so native plugin component. The vulnerability stems from insufficient input validation when processing the filename argument, creating a path for command injection attacks that can be executed remotely without authentication requirements.
The technical flaw represents a classic command injection vulnerability where user-supplied input is directly incorporated into system commands without proper sanitization or escaping mechanisms. When an attacker manipulates the filename parameter passed to the ovpn-client.check_config function, the system fails to properly validate or escape special characters that could alter the intended command execution flow. This allows malicious actors to inject arbitrary shell commands that execute with the privileges of the web server process, typically running with elevated permissions due to the administrative nature of router management interfaces.
The operational impact of this vulnerability is severe given its remote exploitability and the widespread deployment of GL-MT3000 devices in both enterprise and residential environments. Attackers can leverage this weakness to gain full control over affected routers, potentially enabling them to modify network configurations, redirect traffic through malicious proxies, install persistent backdoors, or use the compromised devices as launching points for broader network attacks. The public availability of exploitation tools significantly increases the risk profile, as demonstrated by the vendor's early confirmation of the vulnerability's existence and the documented exploit code.
Mitigation strategies should prioritize immediate firmware updates from GL.iNet to address the identified command injection flaw, while network administrators should implement additional protective measures such as restricting access to the administrative web interface through firewalls and implementing network segmentation. The vulnerability aligns with CWE-77 and CWE-94 classifications under the Common Weakness Enumeration framework, specifically addressing command injection weaknesses that allow arbitrary code execution. From an ATT&CK perspective, this represents a technique for privilege escalation and persistence within network infrastructure, potentially enabling adversaries to establish long-term access to target networks through compromised router devices.