CVE-2026-18615 in GL-MT3000
Summary
by MITRE • 08/03/2026
A vulnerability was determined in GL-iNet GL-MT3000 up to 4.4.5. The affected element is the function wg-server.generate_publickey of the file /cgi-bin/glc of the component wg-server.so Native Plugin. Executing a manipulation of the argument private_key can lead to command injection. The attack may be launched remotely. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure and confirmed the existence of the vulnerability.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 08/03/2026
The GL-iNet GL-MT3000 router model presents a critical command injection vulnerability within its web interface administration system, specifically affecting firmware versions up to 4.4.5. This vulnerability resides in the wg-server.so native plugin component which handles WireGuard VPN server operations through the cgi-bin interface. The affected function wg-server.generate_publickey processes user-provided private_key arguments without adequate input validation or sanitization, creating a dangerous attack surface that allows remote exploitation. The vulnerability manifests when an attacker manipulates the private_key parameter to inject malicious commands that execute within the context of the web server process.
The technical flaw stems from improper handling of user-supplied data within the wg-server.generate_publickey function where the private_key argument undergoes insufficient sanitization before being passed to system-level commands. This design deficiency creates a direct path for command injection attacks, as the system fails to properly escape or validate special characters that could alter the intended execution flow of shell commands. The vulnerability is classified under CWE-78 as improper neutralization of special elements used in OS commands, which represents one of the most dangerous categories of injection flaws in network device firmware. Attackers can leverage this weakness to execute arbitrary code with the privileges of the web server process, potentially gaining full control over the router's operational capabilities and network access.
The operational impact of this vulnerability is severe as it enables remote attackers to compromise the affected devices without requiring authentication or physical access. Once exploited, the attacker gains the ability to execute system commands, modify network configurations, install malicious software, and potentially establish persistent backdoors within the router infrastructure. The vulnerability's public disclosure increases the risk profile significantly since security researchers and malicious actors alike can readily develop and deploy exploits against unpatched systems. Given that this is a native plugin component running with elevated privileges, successful exploitation could allow attackers to manipulate network traffic, intercept communications, or use the device as a pivot point for further attacks within the local network. The affected device serves as a critical network gateway, making it an attractive target for attackers seeking to establish persistent access to corporate or residential networks.
Mitigation strategies should focus on immediate firmware updates from GL-iNet to address the identified vulnerability, as well as implementing network segmentation and monitoring to detect potential exploitation attempts. Organizations should disable unnecessary services and ensure that only authorized users can access the web administration interface of affected devices. Network administrators should consider implementing intrusion detection systems to monitor for suspicious command execution patterns and establish regular security audits of network infrastructure components. The ATT&CK framework categorizes this vulnerability under T1059.001 for command and scripting interpreter, highlighting the need for comprehensive endpoint protection measures. Additionally, implementing proper input validation and output encoding mechanisms in the affected plugin would prevent similar vulnerabilities from occurring in future versions of the firmware.