GL-MT3000 (Firmware <= 4.4.5) - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/products/gl-mt3000-firmware--4.4.5/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioTue, 04 Aug 2026 01:42:16 +0000Remote Command Injection in GL.iNet GL-MT3000https://feed.craftedsignal.io/briefs/2026-08-gl-inet-rce/Tue, 04 Aug 2026 01:42:16 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-08-gl-inet-rce/An unauthenticated remote command injection vulnerability in the GL.iNet GL-MT3000 router allows arbitrary code execution via the /cgi-bin/glc component.A critical security vulnerability (CVE-2026-18685) has been identified in the GL.iNet GL-MT3000 router, specifically within the set_upgrade function located in the modem.so component, invoked via /cgi-bin/glc. This flaw enables unauthenticated, remote attackers to perform command injection, leading to full system compromise. The vulnerability affects firmware versions up to 4.4.5. Publicly available exploit code has been disclosed, significantly lowering the barrier for exploitation by malicious actors. Given the remote accessibility of the target interface and the availability of proof-of-concept material, organizations deploying this hardware should prioritize applying firmware updates or restricting access to the management interface.

Attack Chain

  1. An attacker identifies an internet-facing GL.iNet GL-MT3000 router.
  2. The attacker sends a crafted HTTP request to the target device.
  3. The request targets the /cgi-bin/glc binary.
  4. The input is passed to the vulnerable set_upgrade function within modem.so without proper sanitization.
  5. The set_upgrade function processes the malicious input, leading to command injection.
  6. The injected commands are executed by the underlying operating system.
  7. The attacker achieves arbitrary code execution with elevated privileges on the router.

Impact

Successful exploitation results in full remote control of the affected router. Attackers can leverage the compromised device to intercept network traffic, gain a foothold in the local network, or use the device as part of a botnet. Given the nature of these routers, this compromise presents a significant risk to the privacy and security of all connected clients.

Recommendation

  • Identify all GL.iNet GL-MT3000 devices in the environment and verify the currently installed firmware version.
  • Patch affected devices to the latest firmware version released by GL.iNet immediately to mitigate CVE-2026-18685.
  • Restrict access to the router's web management interface to trusted internal management subnets.
  • Monitor edge device traffic for unusual HTTP requests targeting /cgi-bin/glc originating from external sources.
]]>criticaladvisorycverceiotrouter