Remote Command Injection in GL.iNet GL-MT3000 Firmware

A critical security vulnerability (CVE-2026-18598) exists in the GL.iNet GL-MT3000 wireless router, affecting firmware versions up to 4.4.5. The vulnerability is located within the Logread Lua RPC plugin, specifically in the logread.get_system_log function handled by the /usr/lib/oui-httpd/rpc/logread file. An authenticated remote attacker can manipulate the module argument to inject and execute arbitrary system commands on the underlying host operating system. This vulnerability stems from improper neutralization of special elements used in command execution (CWE-77). Public exploit code for this flaw is available, significantly lowering the barrier for exploitation. Given the network-facing nature of these devices, organizations should prioritize updating to a patched firmware version or restricting access to the management RPC interface.

Attack Chain

1. Attacker performs network reconnaissance to identify reachable GL.iNet management interfaces.
2. Attacker obtains valid low-privileged credentials for the GL-MT3000 web management portal.
3. Attacker accesses the OUI-based RPC service endpoint used by the Logread Lua RPC plugin.
4. Attacker crafts a malicious HTTP request containing a payload injected into the module argument of the logread.get_system_log function.
5. The oui-httpd service processes the request and passes the tainted module argument to the system shell.
6. The system shell executes the attacker-supplied commands with the privileges of the web service process.
7. Attacker achieves remote code execution for persistence, further system exploitation, or network traversal.

Impact

Successful exploitation allows unauthenticated (if PR is bypassed) or low-privileged remote attackers to gain full control over the router. This can lead to complete compromise of the network traffic passing through the device, unauthorized exfiltration of sensitive information, or the potential for lateral movement into the internal network protected by the router.

Recommendation

• Update GL-MT3000 firmware to version 4.4.6 or later immediately to patch CVE-2026-18598.
• Disable remote access to the web management interface on all internet-facing GL.iNet devices.
• Implement strictly limited access control lists (ACLs) for the device management interface.
• Monitor network logs for unusual HTTP POST requests to /rpc/logread or similar paths containing shell metacharacters such as semicolon, pipe, or backticks in query parameters.