CVE-2026-18612 in GL-MT3000
Summary
by MITRE • 08/03/2026
A flaw has been found in GL-iNet GL-MT3000 up to 4.4.5. This vulnerability affects the function plugins.remove_package/plugins.install_package of the file /cgi-bin/glc of the component plugins.so Native Plugin. This manipulation causes command injection. The attack can be initiated remotely. The exploit has been published and may be used. The vendor was contacted early about this disclosure and confirmed the existence of the vulnerability.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 08/03/2026
The GL-iNet GL-MT3000 router firmware version 4.4.5 contains a critical command injection vulnerability within its native plugin component plugins.so. This flaw exists in the cgi-bin/glc file's function handlers for plugins.remove_package and plugins.install_package, which are part of the web interface's administrative functionality. The vulnerability stems from improper input validation and sanitization when processing user-supplied parameters that are directly incorporated into system commands without adequate escaping or filtering mechanisms. This type of vulnerability falls under CWE-77 which specifically addresses command injection flaws where untrusted data is concatenated with shell commands, creating opportunities for malicious code execution.
The remote exploitation capability of this vulnerability presents a significant risk to network security as attackers can leverage the web interface to send malicious payloads through the affected API endpoints. The attack vector involves crafting specially formatted requests that manipulate the plugin installation and removal functions to inject arbitrary commands into the underlying operating system. Once exploited, the attacker gains the ability to execute arbitrary code with the privileges of the web server process, which typically runs with elevated permissions on the device. This aligns with ATT&CK technique T1059.001 for command and scripting interpreter and T1068 for exploit for privilege escalation.
The operational impact extends beyond simple remote code execution as this vulnerability allows for complete system compromise of the affected router. Attackers could potentially modify firmware, install backdoors, exfiltrate sensitive data, or use the device as a pivot point for further network infiltration. The fact that an exploit has been published and is actively available in threat repositories significantly increases the risk profile since automated attacks can be readily deployed without requiring advanced exploitation techniques. This vulnerability affects not only individual devices but also poses risks to entire networks if multiple GL-MT3000 routers are deployed in enterprise or residential environments, as these devices often serve as primary network gateways.
Mitigation strategies should include immediate firmware updates from GL-iNet once available, implementing network segmentation to limit access to the device's administrative interfaces, and applying firewall rules that restrict remote access to the affected ports. Network administrators should also consider monitoring for suspicious traffic patterns and implementing intrusion detection systems that can identify exploitation attempts. The vulnerability demonstrates the critical importance of input validation in web applications and highlights the need for proper security testing of embedded systems before deployment. Organizations should conduct thorough inventory assessments to identify all affected devices and prioritize remediation efforts based on network exposure and criticality. Additionally, implementing secure coding practices that follow OWASP Top Ten guidelines for preventing command injection vulnerabilities can help prevent similar issues in future development cycles.