CVE-2026-18684

Received Received - Intake

Command Injection in GL.iNet GL-MT3000

Publication date: 2026-08-03

Last updated on: 2026-08-03

Assigner: VulDB

Description

A weakness has been identified in GL.iNet GL-MT3000 up to 4.4.5. This issue affects the function remove_profile of the file /cgi-bin/glc of the component modem.so. This manipulation causes command injection. It is possible to initiate the attack remotely. The exploit has been made available to the public and could be used for attacks. The vendor was contacted early about this disclosure and confirmed the existence of the vulnerability.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-03

Last Modified

2026-08-03

Generated

2026-08-04

AI Q&A

2026-08-04

EPSS Evaluated

N/A

NVD

CVE-2026-18684

EUVD

EUVD-2026-52520

Affected Vendors & Products

Vendor	Product	Version / Range
gl.inet	gl-mt3000	to 4.4.5 (inc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-74	The product constructs all or part of a command, data structure, or record using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify how it is parsed or interpreted when it is sent to a downstream component.
CWE-77	The product constructs all or part of a command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended command when it is sent to a downstream component.

Attack-Flow Graph

Executive Summary

This vulnerability is a command injection flaw in GL.iNet GL-MT3000 devices running firmware up to version 4.4.5. It exists in the remove_profile function of the file /cgi-bin/glc, specifically in the modem.so component. Attackers can remotely exploit this to execute arbitrary commands on the device.

Detection Guidance

Detecting this vulnerability requires checking for vulnerable GL.iNet GL-MT3000 devices running firmware up to 4.4.5. Scan your network for devices with the CPE gl.inet:gl-mt3000. Verify if the device exposes the /cgi-bin/glc endpoint and inspect for command injection attempts in logs.

Impact Analysis

This vulnerability allows remote attackers to gain full control of the affected device. They could steal sensitive data, install malware, monitor network traffic, or use the device as part of a botnet. Since the exploit is public, the risk of widespread attacks is high.

Compliance Impact

This vulnerability could lead to unauthorized access and data breaches, violating GDPR and HIPAA requirements for data protection and confidentiality. Organizations using affected devices may face legal penalties, fines, and reputational damage due to non-compliance.

Mitigation Strategies

Immediately update GL.iNet GL-MT3000 firmware to the latest version beyond 4.4.5. If an update is unavailable, isolate the device from untrusted networks. Monitor network traffic for suspicious activity targeting /cgi-bin/glc.

Hi! I’m here to help you understand CVE-2026-18684. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70