Public exploit code has been released, significantly lowering the barrier for exploitation. Given the prevalence of this hardware in edge and small-office network environments, organizations utilizing these devices should prioritize patching or restricting access to the management interface. The vendor has acknowledged the flaw, and users are advised to update to the latest available firmware version that addresses this issue.

Impact

The vulnerability carries a CVSS 3.1 base score of 9.8 (Critical), indicating high risk for confidentiality, integrity, and availability. Successful exploitation grants an attacker administrative control over the router, enabling further network compromise, traffic interception, or the deployment of persistent implants within the affected network.

Recommendation

• Update GL-iNet GL-MT3000 firmware to the latest version immediately to remediate CVE-2026-18612.
• Restrict access to the router's web management interface to trusted internal IP ranges or VPNs.
• Deploy web application firewall or IDS/IPS signatures capable of detecting anomalous POST requests targeting '/cgi-bin/glc' with suspicious shell metacharacters (e.g., ;, |, &&).
• Deploy the provided Sigma rule to monitor for suspicious attempts to access the vulnerable CGI binary.