CVE-2026-18614 is a command injection vulnerability affecting GL-iNet GL-MT3000 devices running firmware versions 4.4.0 through 4.4.5. The flaw exists in the s2s.enable_echo_server function of the /cgi-bin/glc file, part of the s2s.so native plugin. By manipulating the 'port' argument, an attacker can remotely execute arbitrary commands on the device. The vulnerability is remotely exploitable without authentication and has been publicly disclosed. The vendor confirmed the vulnerability but has not yet released an official fix or mitigation.

Successful exploitation allows remote attackers to execute arbitrary commands on affected GL-MT3000 devices without authentication, potentially leading to full system compromise. The high CVSS score (9.3) reflects the critical impact with network attack vector, no required privileges or user interaction, and high impact on confidentiality, integrity, and availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict network access to the affected device's management interfaces to trusted sources only and monitor for suspicious activity related to the s2s.enable_echo_server function. Avoid exposing the device to untrusted networks.