CVE-2026-18614 in GL-MT3000
Summary
by MITRE • 08/03/2026
A vulnerability was found in GL-iNet GL-MT3000 up to 4.4.5. Impacted is the function s2s.enable_echo_server of the file /cgi-bin/glc of the component s2s.so Native Plugin. Performing a manipulation of the argument port results in command injection. The attack may be initiated remotely. The exploit has been made public and could be used. The vendor was contacted early about this disclosure and confirmed the existence of the vulnerability.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 08/03/2026
This vulnerability exists within the GL-iNet GL-MT3000 router firmware version 4.4.5 and earlier, specifically targeting the s2s.so native plugin component. The flaw resides in the s2s.enable_echo_server function located in the /cgi-bin/glc file, which processes user input without proper sanitization or validation. The vulnerability manifests when an attacker manipulates the port argument parameter, creating a command injection scenario that allows arbitrary code execution on the affected device. This represents a critical security flaw classified under CWE-78 as improper neutralization of special elements used in OS commands, enabling attackers to execute malicious commands with the privileges of the web server process.
The remote exploitation capability of this vulnerability significantly amplifies its threat level, as it allows attackers to compromise the device from outside the local network without requiring physical access or prior authentication. The fact that a public exploit has been developed and made available increases the likelihood of successful attacks against unpatched devices. This vulnerability directly maps to attack techniques described in the MITRE ATT&CK framework under T1059.001 for Command and Scripting Interpreter, specifically through OS command injection methods. The compromised device could serve as a foothold for further network infiltration, allowing attackers to establish persistent access points or use the router as a pivot to target other systems within the local network.
The operational impact of this vulnerability extends beyond simple unauthorized access, potentially enabling complete system compromise including data exfiltration, network monitoring, and modification of router configurations. Attackers could leverage this vulnerability to create backdoors, redirect traffic through malicious servers, or use the compromised device as part of a larger botnet operation. Organizations relying on GL-iNet GL-MT3000 routers should immediately assess their network exposure and implement mitigations including network segmentation, firewall rules blocking unauthorized access to the affected web interface, and applying vendor patches upon release. The vulnerability demonstrates the critical importance of input validation in web applications and highlights the risks associated with embedded systems that lack proper security controls for remote administration functions.