CVE-2026-18601 Overview
CVE-2026-18601 is a command injection vulnerability affecting GL.iNet GL-MT3000 routers running firmware up to version 4.4.5. The flaw resides in the ovpn-client.check_config function of the /cgi-bin/glc endpoint, part of the ovpn-client.so native plugin. Attackers can manipulate the filename argument to inject arbitrary operating system commands. The vulnerability is remotely exploitable over the network without authentication, and a public exploit has been disclosed. The vendor has confirmed the issue after early contact regarding disclosure.
Critical Impact
Unauthenticated remote attackers can execute arbitrary commands on affected GL-MT3000 routers, gaining full control of the device and its network traffic.
Affected Products
- GL.iNet GL-MT3000 firmware versions up to and including 4.4.5
- Component: ovpn-client.so Native Plugin
- Endpoint: /cgi-bin/glc (ovpn-client.check_config function)
Discovery Timeline
- 2026-08-03 - CVE-2026-18601 published to NVD
- 2026-08-03 - Last updated in NVD database
Technical Details for CVE-2026-18601
Vulnerability Analysis
The vulnerability is classified as an improper neutralization of special elements in output used by a downstream component [CWE-74], commonly referred to as command injection. It affects the ovpn-client.check_config handler exposed through /cgi-bin/glc, which processes OpenVPN client configuration requests on the GL-MT3000 router.
When the handler receives the filename parameter, it passes the value into a shell command without adequate sanitization. Attackers can embed shell metacharacters in the parameter to break out of the intended command context and execute additional commands. Successful exploitation runs code with the privileges of the web management daemon, typically root on consumer routers.
The EPSS score of 2.38% at the 82nd percentile reflects an elevated likelihood of exploitation compared with average CVEs, aligning with the availability of a public proof of concept.
Root Cause
The root cause is the direct interpolation of the attacker-controlled filename argument into a shell invocation used to validate OpenVPN client configurations. The affected code path does not enforce a strict allow-list, quote the argument safely, or use execve-style APIs that avoid a shell interpreter.
Attack Vector
Exploitation requires network access to the router's HTTP management interface. No authentication or user interaction is required. An attacker submits a crafted request to /cgi-bin/glc targeting the ovpn-client.check_config action with a malicious filename value containing shell metacharacters such as backticks, $(), or ;. The injected commands execute in the context of the web service. Detailed reproduction steps are documented in the GitHub CVE Documentation and the VulDB Vulnerability Details.
Detection Methods for CVE-2026-18601
Indicators of Compromise
- HTTP requests to /cgi-bin/glc referencing the ovpn-client.check_config action with unusual characters in the filename parameter such as ;, |, `, $(, or newline sequences.
- Unexpected child processes spawned by the router web daemon, including /bin/sh, wget, curl, nc, or busybox invocations tied to configuration validation flows.
- Outbound connections from the router to attacker-controlled infrastructure shortly after configuration-related HTTP requests.
- New or modified files in writable partitions (for example /tmp or /etc) that were not created by legitimate firmware operations.
Detection Strategies
- Inspect router access logs and reverse-proxy telemetry for POST or GET requests to /cgi-bin/glc containing shell metacharacters in query parameters or form data.
- Deploy network intrusion detection signatures that match encoded shell operators appearing in filename values submitted to the glc CGI.
- Baseline normal OpenVPN configuration flows and alert on deviations such as abnormally long parameter values or non-ASCII payloads.
Monitoring Recommendations
- Forward router syslog and web-server logs to a central log platform and retain them for retrospective hunting.
- Monitor egress traffic from router management IP ranges for connections to unusual destinations, especially over ports commonly used by reverse shells.
- Track firmware versions across the fleet and alert on any GL-MT3000 device still reporting a version at or below 4.4.5.
How to Mitigate CVE-2026-18601
Immediate Actions Required
- Restrict access to the router's web management interface so it is not reachable from untrusted networks or the internet.
- Disable remote administration features on the GL-MT3000 until a fixed firmware release is applied.
- Audit devices for signs of compromise using the indicators listed above and reimage any device suspected of tampering.
- Rotate credentials, VPN keys, and pre-shared secrets stored on affected routers after remediation.
Patch Information
GL.iNet has confirmed the vulnerability. Administrators should monitor the GL.iNet security advisories and apply firmware updates released after version 4.4.5 for the GL-MT3000. Reference details are also available on the VulDB CVE Entry.
Workarounds
- Place the router's management interface behind a firewall or VLAN accessible only from trusted administrative hosts.
- Block inbound HTTP and HTTPS access to the router from wide area network interfaces at the perimeter.
- Where feasible, disable the OpenVPN client configuration UI features until the device is updated.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
