Remote Command Injection in GL.iNet GL-MT3000

Multiple critical command injection vulnerabilities have been identified in the GL.iNet GL-MT3000 router running firmware versions up to and including 4.4.5. Publicly available exploit code has been disclosed, significantly lowering the barrier for exploitation. Organizations deploying this hardware should prioritize applying firmware updates and restricting access to the management interface.

CVE-2026-18685 — set_upgrade in modem.so

A critical security vulnerability (CVE-2026-18685) has been identified in the GL.iNet GL-MT3000 router, specifically within the set_upgrade function located in the modem.so component, invoked via /cgi-bin/glc. This flaw enables unauthenticated, remote attackers to perform command injection, leading to full system compromise.

Attack Chain

1. An attacker identifies an internet-facing GL.iNet GL-MT3000 router.
2. The attacker sends a crafted HTTP request to the target device.
3. The request targets the /cgi-bin/glc binary.
4. The input is passed to the vulnerable set_upgrade function within modem.so without proper sanitization.
5. The set_upgrade function processes the malicious input, leading to command injection.
6. The injected commands are executed by the underlying operating system.
7. The attacker achieves arbitrary code execution with elevated privileges on the router.

Impact

Successful exploitation results in full remote control of the affected router. Attackers can leverage the compromised device to intercept network traffic, gain a foothold in the local network, or use the device as part of a botnet. Given the nature of these routers, this compromise presents a significant risk to the privacy and security of all connected clients.

CVE-2026-18686 — nas-web.add_user in nas-web RPC Wrapper

A critical command injection vulnerability, identified as CVE-2026-18686, affects the GL.iNet GL-MT3000 router. The vulnerability resides within the nas-web.add_user function of the nas-web RPC wrapper, which is accessible via the /cgi-bin/glc endpoint. The flaw allows an unauthenticated, remote attacker to trigger command injection by manipulating inputs sent to this specific RPC handler.

Attack Chain

1. Attacker performs network reconnaissance to identify GL.iNet GL-MT3000 devices exposing the web administration interface.
2. Attacker crafts a malicious HTTP request directed at the /cgi-bin/glc endpoint.
3. The request targets the nas-web.add_user function within the nas-web RPC wrapper.
4. The attacker injects shell metacharacters into the input parameters expected by the function.
5. The application fails to sanitize the input, passing the attacker-supplied string directly to a system-level command execution routine.
6. The router executes the injected commands with the privileges of the web service process.
7. Final objective: The attacker gains remote code execution on the device, potentially leading to full system compromise or persistence.

Impact

Successful exploitation results in arbitrary command execution on the router with high-level privileges. This enables attackers to reconfigure the network device, exfiltrate sensitive configuration data, pivot into internal networks protected by the router, or deploy persistent malware. The vulnerability affects all users of GL-MT3000 running firmware version 4.4.5 or earlier, significantly increasing the attack surface for remote compromise.

Recommendation

• Identify all GL.iNet GL-MT3000 devices in the environment and verify the currently installed firmware version.
• Patch affected devices to the latest firmware version released by GL.iNet immediately to mitigate CVE-2026-18685 and CVE-2026-18686.
• Restrict access to the router's web management interface to trusted internal management subnets.
• Restrict access to the device web administration interface (/cgi-bin/glc) to trusted management IP addresses via internal firewall rules.
• Monitor edge device traffic for unusual HTTP requests targeting /cgi-bin/glc originating from external sources.
• Enable ingress monitoring on the network perimeter to identify HTTP POST requests directed at /cgi-bin/glc containing unexpected characters or command sequences (e.g., semicolons, pipe symbols, backticks).
• Review network logs for unusual outbound connections originating from GL-MT3000 routers, which may indicate post-exploitation activity.