CVE-2026-18613 is a remote code injection vulnerability in the GL-iNet GL-MT3000 router series affecting versions up to 4.4.5. The flaw resides in the plugins.set_config function within the /cgi-bin/glc file of the plugins.so Native Plugin component. This vulnerability allows an unauthenticated attacker to perform injection attacks remotely, potentially leading to full compromise of confidentiality, integrity, and availability. The vendor has confirmed the vulnerability, and it has been publicly disclosed. The CVSS v3.1 base score is 9.8, indicating critical impact. No official patch or remediation details are currently available.

Successful exploitation can lead to complete compromise of the affected device, including full control over confidentiality, integrity, and availability. The vulnerability can be exploited remotely without authentication, making it highly dangerous. The public disclosure increases the risk of exploitation, although no known exploits in the wild have been reported yet.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict access to the affected device's management interfaces from untrusted networks to reduce exposure. Monitor vendor communications for updates on patches or mitigations.