CVE-2026-18685 in GL-MT3000
Summary
by MITRE • 08/04/2026
A security vulnerability has been detected in GL.iNet GL-MT3000 up to 4.4.5. Impacted is the function set_upgrade of the file /cgi-bin/glc of the component modem.so. Such manipulation leads to command injection. It is possible to launch the attack remotely. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure and confirmed the existence of the vulnerability.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 08/04/2026
The GL.iNet GL-MT3000 router model presents a critical command injection vulnerability within its firmware version 4.4.5 and earlier, specifically affecting the set_upgrade function located in the /cgi-bin/glc file of the modem.so component. This vulnerability represents a severe security flaw that allows remote attackers to execute arbitrary commands on the affected device. The issue stems from improper input validation within the modem.so library, where user-supplied data is directly incorporated into system commands without adequate sanitization or escaping mechanisms. The exploitation of this vulnerability enables attackers to gain unauthorized access to the router's underlying operating system and execute malicious code with the privileges of the affected service.
The technical implementation of this command injection flaw occurs through the set_upgrade function which processes upgrade-related parameters from web requests. When remote users send crafted HTTP requests containing malicious input to the /cgi-bin/glc endpoint, the application fails to properly validate or sanitize these inputs before passing them to shell execution functions. This creates an environment where attackers can inject additional commands that will be executed by the system shell, potentially allowing full system compromise. The vulnerability's remote exploitability means that no physical access or local network presence is required for successful exploitation, making it particularly dangerous in publicly accessible network environments.
The operational impact of this vulnerability extends far beyond simple unauthorized command execution, as it provides attackers with complete control over the router's functionality and potentially exposes the entire network behind the device. An attacker could leverage this vulnerability to modify router configurations, install backdoors, redirect traffic, or even use the compromised device as a pivot point for attacking other systems within the local network. The public disclosure of exploitation techniques significantly increases the risk level, as security researchers and malicious actors can readily implement attacks against unpatched devices. This vulnerability directly maps to CWE-77 in the Common Weakness Enumeration catalog, which specifically addresses command injection flaws where untrusted data is passed to system commands without proper validation or escaping.
Organizations and individuals utilizing GL.iNet GL-MT3000 routers should immediately implement mitigations including firmware updates from the vendor once available, network segmentation to limit access to affected devices, and monitoring for suspicious traffic patterns. The ATT&CK framework categorizes this vulnerability under T1059.001 - Command and Scripting Interpreter: PowerShell, though the actual exploitation occurs at the system shell level rather than through PowerShell specifically. Network administrators should deploy intrusion detection systems to monitor for known exploit signatures targeting this specific vulnerability and consider implementing web application firewalls to filter malicious requests before they reach the vulnerable endpoint. The public disclosure of this vulnerability necessitates immediate action as threat actors are likely already developing or deploying automated exploitation tools against unpatched installations, potentially leading to widespread compromise of affected devices across multiple network environments.
The remediation strategy should focus on immediate firmware updates from GL.iNet, though organizations should also consider implementing network access controls to limit exposure of the vulnerable service to trusted networks only. Additionally, regular security audits of network infrastructure should include verification of device firmware versions and patch status to prevent similar vulnerabilities from remaining unaddressed in other network equipment components.