CVE-2026-18616: Command Injection in GL-iNet GL-MT3000
CVE-2026-18616 is a critical command injection vulnerability in the GL-iNet GL-MT3000 device up to version 4.4.5. The flaw exists in the server.set_peer function within the /cgi-bin/glc file of the wg-server.so Native Plugin, where manipulation of the public_key argument allows remote command injection. Exploitation does not require authentication or user interaction, and a public exploit is available. The vendor has confirmed the vulnerability but no official patch or remediation details are provided yet.
AI Analysis
Technical Summary
This vulnerability affects GL-iNet GL-MT3000 devices running firmware versions 4.4.0 through 4.4.5. The issue is a command injection in the server.set_peer function of the /cgi-bin/glc file in the wg-server.so Native Plugin component. An attacker can remotely manipulate the public_key argument to execute arbitrary commands on the device. The vulnerability has a CVSS 4.0 score of 9.3 (critical) indicating high impact and ease of exploitation. The vendor has been notified and confirmed the issue, but no patch or official remediation guidance is currently available. Exploit code is publicly accessible, increasing the risk of exploitation.
Potential Impact
Successful exploitation allows an unauthenticated remote attacker to execute arbitrary commands on the affected device, potentially leading to full system compromise. This can result in unauthorized control over the device, data exposure, or disruption of device functionality. The high CVSS score reflects the critical nature and remote exploitability of this vulnerability.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider restricting network access to the affected device to trusted sources only and monitor for any unusual activity. Follow updates from GL-iNet for patch availability and apply updates promptly once released.
CVE-2026-18616: Command Injection in GL-iNet GL-MT3000
Description
CVE-2026-18616 is a critical command injection vulnerability in the GL-iNet GL-MT3000 device up to version 4.4.5. The flaw exists in the server.set_peer function within the /cgi-bin/glc file of the wg-server.so Native Plugin, where manipulation of the public_key argument allows remote command injection. Exploitation does not require authentication or user interaction, and a public exploit is available. The vendor has confirmed the vulnerability but no official patch or remediation details are provided yet.
CVSS v4.0
Score 9.3critical
Affected software
GL-iNet
GL-MT3000
pkg:github/gl-inet/GL-MT3000Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
This vulnerability affects GL-iNet GL-MT3000 devices running firmware versions 4.4.0 through 4.4.5. The issue is a command injection in the server.set_peer function of the /cgi-bin/glc file in the wg-server.so Native Plugin component. An attacker can remotely manipulate the public_key argument to execute arbitrary commands on the device. The vulnerability has a CVSS 4.0 score of 9.3 (critical) indicating high impact and ease of exploitation. The vendor has been notified and confirmed the issue, but no patch or official remediation guidance is currently available. Exploit code is publicly accessible, increasing the risk of exploitation.
Potential Impact
Successful exploitation allows an unauthenticated remote attacker to execute arbitrary commands on the affected device, potentially leading to full system compromise. This can result in unauthorized control over the device, data exposure, or disruption of device functionality. The high CVSS score reflects the critical nature and remote exploitability of this vulnerability.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider restricting network access to the affected device to trusted sources only and monitor for any unusual activity. Follow updates from GL-iNet for patch availability and apply updates promptly once released.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- VulDB
- Date Reserved
- 2026-08-03T07:33:34.035Z
- Cvss Version
- 4.0
- State
- PUBLISHED
Threat ID: 6a70e609bf32cb7a340a15f9
Added to database: 08/03/2026, 19:03:37 UTC
Last enriched: 08/11/2026, 18:15:33 UTC
Last updated: 09/17/2026, 22:01:33 UTC
Views: 50
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.