CVE-2026-18600
Received Received - Intake

Command Injection in GL.iNet GL-MT3000

Publication date: 2026-08-03

Last updated on: 2026-08-03

Assigner: VulDB

Description
A vulnerability has been found in GL.iNet GL-MT3000 up to 4.4.5. This affects the function network.switch_info/network.switch_status of the file /usr/lib/oui-httpd/rpc/network of the component Network Lua RPC Plugin. Such manipulation of the argument switch leads to command injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure and confirmed the existence of the vulnerability.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-03
Last Modified
2026-08-03
Generated
2026-08-03
AI Q&A
2026-08-03
EPSS Evaluated
N/A
NVD
CVE-2026-18600
EUVD
EUVD-2026-52267

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
gl.inet gl-mt3000 to 4.4.5 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-74 The product constructs all or part of a command, data structure, or record using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify how it is parsed or interpreted when it is sent to a downstream component.
CWE-77 The product constructs all or part of a command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended command when it is sent to a downstream component.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a command injection vulnerability in GL.iNet GL-MT3000 routers running firmware up to version 4.4.5. The flaw exists in the Network Lua RPC Plugin, specifically in the functions network.switch_info and network.switch_status. An attacker can exploit this by manipulating the 'switch' argument to execute arbitrary commands remotely.

Detection Guidance

Check if your GL.iNet GL-MT3000 device is running firmware version 4.4.5 or earlier. Inspect the file /usr/lib/oui-httpd/rpc/network for the network.switch_info or network.switch_status functions. Look for unusual command execution patterns or unauthorized network changes.

Impact Analysis

An attacker could gain full control over the affected router, allowing them to execute commands with high privileges. This could lead to unauthorized access, data theft, network compromise, or disruption of services. The high CVSS scores indicate significant risk of confidentiality, integrity, and availability impacts.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating confidentiality requirements in GDPR and HIPAA. Organizations using affected GL.iNet devices may face compliance violations, data breach notifications, and potential fines if exploited.

Mitigation Strategies

Update the GL.iNet GL-MT3000 firmware to the latest version beyond 4.4.5. Disable remote access to the network RPC plugin if not required. Monitor network traffic for suspicious activity and restrict access to the device's administrative interface.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-18600. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart