Remote Command Injection Vulnerability in GL.iNet GL-MT3000

A critical command injection vulnerability, identified as CVE-2026-18686, affects the GL.iNet GL-MT3000 router running firmware versions up to and including 4.4.5. The vulnerability resides within the 'nas-web.add_user' function of the 'nas-web' RPC wrapper, which is accessible via the '/cgi-bin/glc' endpoint.

The flaw allows an unauthenticated, remote attacker to trigger command injection by manipulating inputs sent to this specific RPC handler. Because this interface is reachable over the network, it presents a significant risk to affected devices. Proof-of-concept (PoC) exploit code is publicly available, increasing the likelihood of exploitation. This vulnerability is categorized under CWE-77 (Improper Neutralization of Special Elements used in a Command). Given the high base CVSS score, owners of these devices are advised to update firmware immediately upon the availability of security patches.

Attack Chain

1. Attacker performs network reconnaissance to identify GL.iNet GL-MT3000 devices exposing the web administration interface.
2. Attacker crafts a malicious HTTP request directed at the '/cgi-bin/glc' endpoint.
3. The request targets the 'nas-web.add_user' function within the nas-web RPC wrapper.
4. The attacker injects shell metacharacters into the input parameters expected by the function.
5. The application fails to sanitize the input, passing the attacker-supplied string directly to a system-level command execution routine.
6. The router executes the injected commands with the privileges of the web service process.
7. Final objective: The attacker gains remote code execution on the device, potentially leading to full system compromise or persistence.

Impact

Successful exploitation results in arbitrary command execution on the router with high-level privileges. This enables attackers to reconfigure the network device, exfiltrate sensitive configuration data, pivot into internal networks protected by the router, or deploy persistent malware. The vulnerability affects all users of GL-MT3000 running firmware version 4.4.5 or earlier, significantly increasing the attack surface for remote compromise.

Recommendation

• Upgrade GL-MT3000 firmware to the latest available version provided by GL.iNet to patch CVE-2026-18686.
• Restrict access to the device web administration interface (/cgi-bin/glc) to trusted management IP addresses via internal firewall rules.
• Enable ingress monitoring on the network perimeter to identify HTTP POST requests directed at '/cgi-bin/glc' containing unexpected characters or command sequences (e.g., semicolons, pipe symbols, backticks).
• Review network logs for unusual outbound connections originating from GL-MT3000 routers, which may indicate post-exploitation activity.