A vulnerability was found in GL.iNet GL-MT3000 up to 4.4.5. (CVE-2026-18601)
A command injection vulnerability exists in the GL.iNet GL-MT3000 device up to version 4.4.5. The flaw is located in the ovpn-client.check_config function within the /cgi-bin/glc endpoint of the ovpn-client.so native plugin. An attacker can manipulate the filename argument to execute arbitrary commands remotely without authentication. The vulnerability has a high severity score of 9.8 and has been confirmed by the vendor. No patch or remediation information is currently available.
AI Analysis
Technical Summary
The GL.iNet GL-MT3000 device up to version 4.4.5 contains a command injection vulnerability (CVE-2026-18601) in the ovpn-client.check_config function of the ovpn-client.so native plugin, accessible via the /cgi-bin/glc endpoint. This vulnerability allows remote attackers to execute arbitrary commands by manipulating the filename argument. The vulnerability has a CVSS 3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), indicating it is remotely exploitable without privileges or user interaction and can lead to full system compromise. The vendor has confirmed the issue but no patch or official fix has been provided yet. The exploit code has been publicly disclosed.
Potential Impact
Successful exploitation allows remote attackers to execute arbitrary commands on the affected device, leading to complete compromise of confidentiality, integrity, and availability. This can result in full control over the device and potentially the network it is connected to.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the vulnerable endpoint and consider disabling the ovpn-client functionality if possible to reduce exposure.
A vulnerability was found in GL.iNet GL-MT3000 up to 4.4.5. (CVE-2026-18601)
Description
A command injection vulnerability exists in the GL.iNet GL-MT3000 device up to version 4.4.5. The flaw is located in the ovpn-client.check_config function within the /cgi-bin/glc endpoint of the ovpn-client.so native plugin. An attacker can manipulate the filename argument to execute arbitrary commands remotely without authentication. The vulnerability has a high severity score of 9.8 and has been confirmed by the vendor. No patch or remediation information is currently available.
CVSS v3.1
Score 9.8critical
Affected software
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The GL.iNet GL-MT3000 device up to version 4.4.5 contains a command injection vulnerability (CVE-2026-18601) in the ovpn-client.check_config function of the ovpn-client.so native plugin, accessible via the /cgi-bin/glc endpoint. This vulnerability allows remote attackers to execute arbitrary commands by manipulating the filename argument. The vulnerability has a CVSS 3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), indicating it is remotely exploitable without privileges or user interaction and can lead to full system compromise. The vendor has confirmed the issue but no patch or official fix has been provided yet. The exploit code has been publicly disclosed.
Potential Impact
Successful exploitation allows remote attackers to execute arbitrary commands on the affected device, leading to complete compromise of confidentiality, integrity, and availability. This can result in full control over the device and potentially the network it is connected to.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the vulnerable endpoint and consider disabling the ovpn-client functionality if possible to reduce exposure.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- GHSA-qv2j-hh7r-m4m2
- Osv Schema Version
- 1.4.0
- Aliases
- ["CVE-2026-18601"]
- Ecosystems
- []
- Database Specific Severity
- HIGH
- Cvss Version
- 3.1
Threat ID: 6a710669bf32cb7a34394ef8
Added to database: 08/03/2026, 21:21:45 UTC
Last enriched: 08/03/2026, 21:33:33 UTC
Last updated: 08/04/2026, 03:17:46 UTC
Views: 3
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.