CVE-2026-18600: GL.iNet GL-MT3000 RCE Vulnerability

CVE-2026-18600 Overview

CVE-2026-18600 is a command injection vulnerability in GL.iNet GL-MT3000 routers running firmware versions up to 4.4.5. The flaw resides in the network.switch_info and network.switch_status functions within /usr/lib/oui-httpd/rpc/network, part of the Network Lua RPC Plugin. Attackers can manipulate the switch argument to inject arbitrary shell commands. The vulnerability is remotely exploitable and has been publicly disclosed. GL.iNet confirmed the existence of the vulnerability after early vendor contact.

Critical Impact
Authenticated remote attackers can execute arbitrary operating system commands on affected GL-MT3000 devices, compromising router integrity and any network segment behind it.

Affected Products

GL.iNet GL-MT3000 firmware versions up to and including 4.4.5
Network Lua RPC Plugin component (/usr/lib/oui-httpd/rpc/network)
network.switch_info and network.switch_status RPC functions

Discovery Timeline

2026-08-03 - CVE-2026-18600 published to NVD
2026-08-03 - Last updated in NVD database

Technical Details for CVE-2026-18600

Vulnerability Analysis

The vulnerability [CWE-74] exists in the Lua-based RPC handler exposed by the oui-httpd daemon on GL.iNet GL-MT3000 routers. The network.switch_info and network.switch_status methods accept a switch parameter that is passed unsanitized into a shell command execution context. Attackers who reach the RPC endpoint can inject shell metacharacters into this argument. The injected payload executes with the privileges of the oui-httpd process, which typically runs as root on GL.iNet devices. Successful exploitation yields full control of the router operating system.

Root Cause

The root cause is improper neutralization of special elements in a downstream component. The Lua RPC handler concatenates the caller-supplied switch value into a system command string without validation, escaping, or use of a safe execution API. Any shell metacharacter (;, |, `, $()) in the parameter is interpreted by the shell rather than treated as literal data.

Attack Vector

Exploitation occurs over the network against the router's HTTP RPC interface. The attacker sends a crafted JSON-RPC request that invokes network.switch_info or network.switch_status with a malicious switch argument containing shell injection payloads. The attack requires low privileges on the RPC endpoint but no user interaction. Devices exposing the management interface to untrusted networks face the highest risk.

No verified proof-of-concept code is reproduced here. Technical details are documented in the GitHub CVE writeup and VulDB entry.

Detection Methods for CVE-2026-18600

Indicators of Compromise

HTTP POST requests to /rpc or /cgi-bin/oui-httpd containing network.switch_info or network.switch_status method calls with unusual switch parameter values.
Presence of shell metacharacters (;, &, |, `, $() inside JSON-RPC request bodies targeting the network module.
Unexpected child processes spawned by oui-httpd, such as sh, wget, curl, nc, or busybox invocations.
New or modified files under /tmp, /var, or /etc on the router shortly after RPC calls.

Detection Strategies

Inspect HTTP request logs on the router for RPC calls to the network namespace containing non-alphanumeric characters in argument values.
Deploy network intrusion detection signatures that match JSON payloads referencing switch_info or switch_status with embedded shell operators.
Monitor outbound connections initiated by GL-MT3000 devices to unfamiliar destinations, which may indicate post-exploitation callbacks.

Monitoring Recommendations

Forward oui-httpd and system logs from GL.iNet devices to a central log store for correlation and retention.
Alert on any process execution originating from oui-httpd outside its normal Lua handler set.
Track firmware version inventory across managed GL.iNet devices to identify unpatched GL-MT3000 units running 4.4.5 or earlier.

How to Mitigate CVE-2026-18600

Immediate Actions Required

Restrict access to the GL-MT3000 web and RPC management interfaces to trusted management VLANs only; block WAN-side access.
Rotate all administrative credentials on affected devices, since authenticated RPC access is a prerequisite for exploitation.
Audit recently issued RPC calls and running processes on each GL-MT3000 for signs of prior exploitation.
Apply the vendor-supplied firmware update as soon as GL.iNet publishes a patched release for GL-MT3000.

Patch Information

GL.iNet confirmed the vulnerability after coordinated disclosure. At publication time, users should consult the GL.iNet firmware download portal and the VulDB advisory for the latest fixed firmware version for GL-MT3000. Devices running firmware 4.4.5 or earlier remain vulnerable until updated.

Workarounds

Disable remote management and confine the router's LuCI/oui-httpd interface to LAN clients only.
Place the router's management interface behind a firewall or VPN to prevent untrusted networks from reaching the RPC endpoint.
Segment IoT and guest networks from the management VLAN to limit the pool of clients that can authenticate to the RPC service.
Where feasible, replace the affected device with a supported model until patched firmware is deployed.

bash

# Example: restrict oui-httpd to LAN interface via UCI on OpenWrt-based GL.iNet firmware
uci set uhttpd.main.listen_http='192.168.8.1:80'
uci set uhttpd.main.listen_https='192.168.8.1:443'
uci commit uhttpd
/etc/init.d/uhttpd restart

# Drop WAN-side access to management ports
uci add firewall rule
uci set firewall.@rule[-1].name='Block-WAN-Mgmt'
uci set firewall.@rule[-1].src='wan'
uci set firewall.@rule[-1].proto='tcp'
uci set firewall.@rule[-1].dest_port='80 443'
uci set firewall.@rule[-1].target='DROP'
uci commit firewall
/etc/init.d/firewall restart