CVE-2026-18602
Received Received - Intake

Command Injection in GL.iNet GL-MT3000

Publication date: 2026-08-03

Last updated on: 2026-08-03

Assigner: VulDB

Description
A vulnerability was determined in GL.iNet GL-MT3000 up to 4.4.5. Affected is the function ovpn-client.get_recommend_config of the file /cgi-bin/glc of the component ovpn-client.so Native Plugin. Executing a manipulation of the argument Hostname can lead to command injection. The attack can be executed remotely. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure and confirmed the existence of the vulnerability.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-03
Last Modified
2026-08-03
Generated
2026-08-03
AI Q&A
2026-08-03
EPSS Evaluated
N/A
NVD
CVE-2026-18602
EUVD
EUVD-2026-52335

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
gl.inet gl-mt3000 to 4.4.5 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-74 The product constructs all or part of a command, data structure, or record using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify how it is parsed or interpreted when it is sent to a downstream component.
CWE-77 The product constructs all or part of a command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended command when it is sent to a downstream component.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is a command injection flaw in GL.iNet GL-MT3000 devices running firmware up to version 4.4.5. It exists in the ovpn-client.get_recommend_config function within the /cgi-bin/glc file of the ovpn-client.so Native Plugin. An attacker can remotely exploit this by manipulating the Hostname argument to execute arbitrary commands on the device.

Detection Guidance

This vulnerability involves command injection via the Hostname argument in GL.iNet GL-MT3000 devices running firmware up to 4.4.5. To detect it, inspect network traffic for suspicious requests to /cgi-bin/glc with manipulated Hostname parameters. Check device logs for unusual command execution patterns or unauthorized access attempts.

Impact Analysis

This vulnerability allows remote attackers to execute arbitrary commands on your GL.iNet GL-MT3000 device. This could lead to full system compromise, unauthorized access, data theft, or disruption of device functionality. Since the exploit is publicly available, attackers may actively target unpatched devices.

Compliance Impact

This vulnerability could lead to unauthorized access and data breaches, which may violate compliance requirements under GDPR (data protection) and HIPAA (health information security). Organizations using affected devices must address this flaw to maintain regulatory compliance and protect sensitive data.

Mitigation Strategies

Immediately update GL.iNet GL-MT3000 firmware to the latest version beyond 4.4.5. Disable remote access to the device if not required. Monitor network traffic for signs of exploitation. If an update is unavailable, consider isolating the device from critical networks until a patch is applied.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-18602. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart