CVE-2026-18613
Received Received - Intake

Remote Code Injection in GL-iNet GL-MT3000

Publication date: 2026-08-03

Last updated on: 2026-08-03

Assigner: VulDB

Description
A vulnerability has been found in GL-iNet GL-MT3000 up to 4.4.5. This issue affects the function plugins.set_config of the file /cgi-bin/glc of the component plugins.so Native Plugin. Such manipulation leads to injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure and confirmed the existence of the vulnerability.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-03
Last Modified
2026-08-03
Generated
2026-08-03
AI Q&A
2026-08-03
EPSS Evaluated
N/A
NVD
CVE-2026-18613
EUVD
EUVD-2026-52397

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
gl-inet gl-mt3000 to 4.4.5 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-707 The product does not ensure or incorrectly ensures that structured messages or data are well-formed and that certain security properties are met before being read from an upstream component or sent to a downstream component.
CWE-74 The product constructs all or part of a command, data structure, or record using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify how it is parsed or interpreted when it is sent to a downstream component.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is a remote code injection flaw in the GL-iNet GL-MT3000 router up to version 4.4.5. It exists in the plugins.set_config function of the /cgi-bin/glc file within the plugins.so component. An attacker can remotely inject malicious code due to improper input validation.

Impact Analysis

This vulnerability allows remote attackers to execute arbitrary code on the affected device. This could lead to unauthorized access, data theft, or disruption of network services. Users of GL-MT3000 routers running versions up to 4.4.5 are at risk.

Compliance Impact

This vulnerability could lead to unauthorized access and data breaches, which may violate compliance requirements under GDPR, HIPAA, or other regulations. Organizations using affected devices must address this flaw to maintain regulatory compliance.

Mitigation Strategies

Immediately update GL-iNet GL-MT3000 to a version beyond 4.4.5 to address the injection vulnerability in plugins.set_config. Disable remote access to /cgi-bin/glc if not required. Monitor network traffic for unusual activity targeting this component.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-18613. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart