CVE-2026-18613 in GL-MT3000
Summary
by MITRE • 08/03/2026
A vulnerability has been found in GL-iNet GL-MT3000 up to 4.4.5. This issue affects the function plugins.set_config of the file /cgi-bin/glc of the component plugins.so Native Plugin. Such manipulation leads to injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure and confirmed the existence of the vulnerability.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 08/03/2026
The GL-iNet GL-MT3000 router firmware version 4.4.5 contains a critical command injection vulnerability within its native plugin system that poses significant security risks to affected networks. This vulnerability exists in the plugins.set_config function of the /cgi-bin/glc file, specifically within the plugins.so native plugin component. The flaw allows remote attackers to execute arbitrary commands on the device by manipulating input parameters passed to this function, effectively creating a backdoor for unauthorized access and system compromise.
The technical nature of this vulnerability aligns with CWE-77 which describes command injection flaws where untrusted data is incorporated into system commands without proper validation or sanitization. The attack vector is particularly concerning as it enables remote exploitation without requiring authentication, making the device susceptible to automated attacks from any network location. The disclosure of exploit code by threat actors significantly increases the risk profile since malicious parties can immediately leverage this vulnerability for unauthorized access, data exfiltration, or further network infiltration activities.
The operational impact of this vulnerability extends beyond simple unauthorized access as it fundamentally compromises the integrity and confidentiality of network infrastructure. Attackers who successfully exploit this command injection flaw can gain full administrative control over the router, potentially enabling them to modify network configurations, redirect traffic through malicious proxies, establish persistent backdoors, or use the device as a launch point for attacks against other systems within the local network. This represents a critical weakness in the device's security architecture, particularly concerning default configurations that often remain unchanged by end users.
Security professionals should implement immediate mitigation strategies including firmware updates from GL-iNet once available, network segmentation to isolate affected devices, and monitoring for suspicious network activity that might indicate exploitation attempts. Organizations should also consider disabling unnecessary services and implementing firewall rules that restrict access to the vulnerable CGI endpoint until proper patches are applied. The vulnerability demonstrates the importance of secure coding practices in embedded systems and highlights the need for comprehensive input validation in web-based administrative interfaces. Additional protective measures include regular security assessments of network infrastructure, implementation of intrusion detection systems, and establishment of incident response procedures specifically addressing router compromise scenarios. This vulnerability serves as a reminder of the critical security considerations required when developing and deploying network infrastructure devices that handle administrative functions through web interfaces.