The vulnerability CVE-2026-18684 affects GL.iNet GL-MT3000 devices up to version 4.4.5. It is a command injection flaw in the remove_profile function of the /cgi-bin/glc script in the modem.so component. This weakness allows unauthenticated remote attackers to execute arbitrary commands on the affected device. The vulnerability has a CVSS 4.0 base score of 9.3, indicating critical severity with network attack vector, no required privileges or user interaction, and high impact on confidentiality, integrity, and availability. The vendor has acknowledged the vulnerability but has not yet provided an official fix or mitigation. Exploit code is publicly available.

Successful exploitation of this vulnerability allows remote attackers to execute arbitrary commands on the GL.iNet GL-MT3000 device without authentication. This can lead to full compromise of the device, including unauthorized access, data manipulation, and disruption of device functionality. The critical CVSS score reflects the high potential impact on confidentiality, integrity, and availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider restricting network access to the device's management interface to trusted networks only and monitor for suspicious activity. Avoid exposing the device management interface to untrusted networks. Follow vendor communications for updates on patches or official mitigations.