CVE-2026-26791 in GL-AR300M16
Summary
by MITRE • 03/12/2026
GL-iNet GL-AR300M16 v4.3.11 was discovered to contain a command injection vulnerability via the string port parameter in the enable_echo_server function. This vulnerability allows attackers to execute arbitrary commands via a crafted input.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 03/19/2026
The vulnerability identified as CVE-2026-26791 represents a critical command injection flaw within the GL-iNet GL-AR300M16 router firmware version 4.3.11. This device operates as a wireless router and firewall appliance commonly deployed in small office and home environments, making it a prime target for attackers seeking to compromise network infrastructure. The vulnerability specifically resides in the enable_echo_server function which processes user input through the string port parameter, creating an avenue for malicious command execution. The affected device runs on an embedded Linux system with standard network services and administrative interfaces that are typically exposed to network traffic.
The technical implementation of this vulnerability stems from improper input validation and sanitization within the router's web interface administrative module. When an attacker submits a crafted port parameter value to the enable_echo_server function, the system fails to properly escape or validate the input before incorporating it into system commands. This allows for arbitrary command injection through shell metacharacters such as semicolons, pipes, or backticks that would normally be interpreted by the underlying shell. The vulnerability is classified as a command injection flaw under CWE-77, which specifically addresses situations where user-controllable data is passed to system commands without proper sanitization. The attack vector typically occurs through the web-based management interface where administrative users can configure network services including echo server functionality.
The operational impact of this vulnerability is severe and multifaceted, affecting both network security and device integrity. An attacker who successfully exploits this vulnerability gains the ability to execute arbitrary commands with the privileges of the web server process, which typically runs with elevated permissions on embedded systems. This could enable complete system compromise including but not limited to remote code execution, data exfiltration, network reconnaissance, and persistent backdoor installation. The vulnerability affects all users of the GL-AR300M16 firmware version 4.3.11 regardless of authentication status, making it particularly dangerous as it can be exploited through unauthenticated network access. From an attacker perspective, this vulnerability aligns with ATT&CK technique T1059.001 for command and scripting interpreter and T1078.004 for valid accounts, as it allows for command execution without requiring legitimate credentials after initial network access. The compromised device could serve as a pivot point for lateral movement within the local network, potentially enabling attackers to access connected IoT devices, workstations, or network servers.
Mitigation strategies for this vulnerability should encompass multiple layers of defense to protect affected systems. Immediate remediation involves updating the firmware to a version that properly sanitizes input parameters before processing them in system commands. Network administrators should also implement firewall rules to restrict access to the router's administrative interface to trusted IP addresses only, reducing the attack surface for remote exploitation attempts. Additionally, implementing network segmentation and monitoring for suspicious command execution patterns can help detect exploitation attempts. The vulnerability demonstrates the importance of input validation practices and adheres to security principles outlined in NIST SP 800-160 and OWASP Top 10, particularly focusing on preventing injection flaws that could lead to arbitrary code execution. Organizations should also conduct regular vulnerability assessments and penetration testing of network infrastructure devices to identify similar issues in other embedded systems and network appliances. The incident highlights the necessity of secure coding practices in embedded systems development and proper input validation mechanisms that prevent malicious data from being interpreted as executable commands by the underlying operating system.