CVE-2026-18600 is a command injection vulnerability in GL.iNet GL-MT3000 devices up to version 4.4.5. The flaw resides in the network.switch_info and network.switch_status functions of the /usr/lib/oui-httpd/rpc/network component, specifically in the Network Lua RPC Plugin. By manipulating the switch argument, an attacker with network access and limited privileges can remotely execute arbitrary commands on the device. The vulnerability has a CVSS 3.1 base score of 8.8, indicating high severity with network attack vector, low attack complexity, no user interaction, and high impact on confidentiality, integrity, and availability. The vendor has confirmed the vulnerability but no patch or remediation details are provided in the available data.

Successful exploitation allows remote attackers with limited privileges to execute arbitrary commands on affected GL.iNet GL-MT3000 devices, potentially leading to full compromise of the device, including confidentiality, integrity, and availability impacts. This could enable attackers to control network traffic or disrupt device operations.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a patch is available, restrict network access to the affected device's management interfaces to trusted users only. Monitor vendor communications for updates on official fixes.