CVE-2026-18602 in GL-MT3000
Summary
by MITRE • 08/03/2026
A vulnerability was determined in GL.iNet GL-MT3000 up to 4.4.5. Affected is the function ovpn-client.get_recommend_config of the file /cgi-bin/glc of the component ovpn-client.so Native Plugin. Executing a manipulation of the argument Hostname can lead to command injection. The attack can be executed remotely. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure and confirmed the existence of the vulnerability.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 08/03/2026
The GL.iNet GL-MT3000 router firmware version 4.4.5 contains a critical command injection vulnerability within its openvpn client component that poses significant security risks to affected networks. This vulnerability resides in the ovpn-client.get_recommend_config function of the /cgi-bin/glc file, which is part of the ovpn-client.so native plugin module. The flaw specifically manifests when processing the Hostname argument parameter, allowing attackers to inject malicious commands that execute with elevated privileges on the underlying system. The vulnerability has been publicly disclosed and confirmed by the vendor as a legitimate security concern, indicating that threat actors may already be exploiting this weakness in the wild.
The technical exploitation of this vulnerability follows established patterns for command injection attacks within web application interfaces. When the Hostname parameter is manipulated through the ovpn-client.get_recommend_config function, the system fails to properly sanitize or validate user input before incorporating it into system commands. This lack of proper input validation creates a direct pathway for attackers to execute arbitrary code on the router's operating system. The vulnerability operates at the application layer and can be exploited remotely without requiring physical access to the device, making it particularly dangerous in networked environments where routers are exposed to external traffic.
The operational impact of this vulnerability extends beyond simple unauthorized command execution, as it provides attackers with complete control over the affected router's functionality. Successful exploitation could enable adversaries to modify network configurations, establish persistent backdoors, intercept network traffic, or use the device as a pivot point for attacking other systems within the local network. The attack surface is particularly concerning because routers serve as fundamental network infrastructure components that often lack robust security monitoring capabilities, making it difficult to detect unauthorized access attempts. This vulnerability directly aligns with CWE-77 and CWE-94 categories, representing command injection flaws that can lead to arbitrary code execution.
Mitigation strategies for this vulnerability should prioritize immediate firmware updates from GL.iNet, as the vendor has acknowledged the issue and likely provided patches addressing the input sanitization weakness in the ovpn-client.so plugin. Network administrators should also implement additional protective measures including firewall rules that restrict access to the affected CGI interface, monitoring for unusual network traffic patterns that may indicate exploitation attempts, and disabling unnecessary VPN client functionality if not required. The vulnerability demonstrates the importance of proper input validation and secure coding practices as outlined in MITRE ATT&CK framework's T1059.007 technique for command and script injection, emphasizing the need for comprehensive security testing of network device web interfaces to prevent similar issues in other embedded systems.