CVE-2026-18602 Overview
CVE-2026-18602 is a command injection vulnerability in the GL.iNet GL-MT3000 travel router running firmware up to version 4.4.5. The flaw resides in the ovpn-client.get_recommend_config function of the ovpn-client.so native plugin, invoked through the /cgi-bin/glc endpoint. An unauthenticated attacker can manipulate the Hostname argument to inject arbitrary operating system commands. The attack is executed over the network and requires no user interaction. The vendor confirmed the vulnerability after early disclosure, and the exploit has been publicly disclosed.
Critical Impact
Remote, unauthenticated command injection against the router's CGI interface enables full compromise of the device, including traffic interception and lateral movement into the connected network.
Affected Products
- GL.iNet GL-MT3000 firmware versions up to and including 4.4.5
- Component: ovpn-client.so native plugin
- Endpoint: /cgi-bin/glc handling the ovpn-client.get_recommend_config function
Discovery Timeline
- 2026-08-03 - CVE CVE-2026-18602 published to NVD
- 2026-08-03 - Last updated in NVD database
Technical Details for CVE-2026-18602
Vulnerability Analysis
The vulnerability is a classic OS command injection classified under CWE-74, improper neutralization of special elements in output used by a downstream component. The ovpn-client.get_recommend_config handler accepts a Hostname parameter from the HTTP request and passes it to a shell context without sanitization. Attackers embed shell metacharacters such as backticks, semicolons, or $() sequences in the Hostname field to break out of the intended argument boundary. The injected payload executes with the privileges of the CGI process on the router, typically root on consumer embedded devices.
Root Cause
The ovpn-client.so plugin constructs a command string using attacker-controllable input from the request body. The Hostname argument is concatenated into a shell invocation rather than passed via a safe execution primitive such as execve with a fixed argument array. No input validation, allow-listing, or escaping is applied before the command reaches the shell interpreter.
Attack Vector
Exploitation is remote and unauthenticated. An attacker sends a crafted HTTP request to /cgi-bin/glc invoking the ovpn-client.get_recommend_config method with a malicious Hostname value. Because the attack traverses the network path exposed by the router's management interface, any host that can reach the LAN or WAN-facing web UI can trigger the flaw. Public disclosure of the exploit increases the likelihood of automated scanning against exposed GL-MT3000 devices. Technical details are documented in the GitHub CVE overview and the VulDB entry for CVE-2026-18602.
Detection Methods for CVE-2026-18602
Indicators of Compromise
- HTTP POST or GET requests to /cgi-bin/glc referencing the ovpn-client.get_recommend_config method with unusual characters in the Hostname parameter.
- Presence of shell metacharacters such as ;, |, `, $(, or && inside the Hostname field of OpenVPN client configuration requests.
- Unexpected outbound connections from the router, new listening services, or modifications to /etc/ and /tmp/ files on the device.
Detection Strategies
- Inspect router access logs and upstream network telemetry for requests to /cgi-bin/glc with encoded shell payloads in POST bodies.
- Alert on router-originated traffic to unfamiliar external hosts, particularly reverse-shell ports or file download requests via wget or curl.
- Compare running processes and cron entries on the device against a known-good baseline to identify persistence artifacts.
Monitoring Recommendations
- Deploy network intrusion detection signatures targeting the specific URI path and function name combined with shell metacharacters.
- Monitor DNS queries originating from the router for lookups to attacker-controlled infrastructure.
- Aggregate router syslog output to a central collector so tampering with local logs does not eliminate evidence.
How to Mitigate CVE-2026-18602
Immediate Actions Required
- Restrict access to the GL-MT3000 web management interface to trusted LAN segments and disable remote WAN administration.
- Disable the OpenVPN client feature until a patched firmware image is installed if the feature is not required.
- Rotate any credentials, VPN keys, and pre-shared secrets stored on affected devices, treating exposed routers as compromised.
Patch Information
GL.iNet confirmed the vulnerability after early disclosure. Administrators should monitor the GL.iNet firmware download portal and the VulDB advisory for CVE-2026-18602 for a fixed firmware release beyond version 4.4.5 and apply it as soon as it becomes available.
Workarounds
- Place the router behind an upstream firewall that blocks unsolicited inbound access to TCP ports 80 and 443 of the device.
- Enforce network segmentation so that untrusted clients on guest Wi-Fi cannot reach /cgi-bin/glc.
- Consider replacing the device with a patched alternative in high-risk deployments until vendor remediation is confirmed.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
