Threats affecting pkg:github/gl-inet/GL-MT3000

GL.iNet GL-MT3000 devices up to version 4.4.5 contain a remote command injection vulnerability in the ovpn-client.get_recommend_config function within the ovpn-client.so plugin. This vulnerability arises from improper handling of the Hostname argument, allowing an attacker to execute arbitrary commands remotely without authentication. The vulnerability has a high severity with a CVSS score of 9.8 and has been publicly disclosed. The vendor has confirmed the issue but no patch information is currently available.

CVE-2026-18616 is a critical command injection vulnerability in the GL-iNet GL-MT3000 device up to version 4.4.5. The flaw exists in the server.set_peer function within the /cgi-bin/glc file of the wg-server.so Native Plugin, where manipulation of the public_key argument allows remote command injection. Exploitation does not require authentication or user interaction, and a public exploit is available. The vendor has confirmed the vulnerability but no official patch or remediation details are provided yet.

A vulnerability was determined in GL-iNet GL-MT3000 up to 4.4.5. The affected element is the function wg-server.generate_publickey of the file /cgi-bin/glc of the component wg-server.so Native Plugin. Executing a manipulation of the argument private_key can lead to command injection. The attack may be launched remotely. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure and confirmed the existence of the vulnerability.

A vulnerability was found in GL-iNet GL-MT3000 up to 4.4.5. Impacted is the function s2s.enable_echo_server of the file /cgi-bin/glc of the component s2s.so Native Plugin. Performing a manipulation of the argument port results in command injection. The attack may be initiated remotely. The exploit has been made public and could be used. The vendor was contacted early about this disclosure and confirmed the existence of the vulnerability.