CVE-2026-18612 Overview
CVE-2026-18612 is a command injection vulnerability affecting GL-iNet GL-MT3000 routers running firmware versions up to 4.4.5. The flaw resides in the plugins.remove_package and plugins.install_package functions of the /cgi-bin/glc endpoint, which is served by the plugins.so native plugin. Unauthenticated attackers can manipulate the package name parameter to inject arbitrary operating system commands. The vendor confirmed the vulnerability after disclosure, and a public exploit has been released.
Critical Impact
Remote, unauthenticated attackers can execute arbitrary commands on affected GL-MT3000 devices, leading to full device compromise, network pivoting, and interception of routed traffic.
Affected Products
- GL-iNet GL-MT3000 router firmware versions up to and including 4.4.5
- plugins.so native plugin component
- /cgi-bin/glc CGI endpoint
Discovery Timeline
- 2026-08-03 - CVE-2026-18612 published to NVD
- 2026-08-03 - Last updated in NVD database
Technical Details for CVE-2026-18612
Vulnerability Analysis
The vulnerability exists in the plugin management routines exposed through the /cgi-bin/glc CGI handler on the GL-MT3000. Two functions in the plugins.so native library, plugins.remove_package and plugins.install_package, accept a package name parameter supplied over HTTP. This parameter flows into a shell command invocation without adequate sanitization, resulting in a command injection primitive classified under [CWE-74] (Improper Neutralization of Special Elements in Output Used by a Downstream Component). Because the router exposes the endpoint over the network and the affected code path does not require authentication in typical configurations, attackers can trigger the flaw remotely. Successful exploitation yields command execution with the privileges of the CGI process, which on most GL-iNet firmware runs as root.
Root Cause
The root cause is unsafe concatenation of attacker-controlled input into a system shell call inside the native plugin loader. Package name values are passed to a shell interpreter without escaping metacharacters such as ;, |, `, or $(), allowing arbitrary command sequences to be executed alongside the intended package operation.
Attack Vector
Exploitation is performed over the network by issuing a crafted HTTP request to /cgi-bin/glc invoking the plugins.install_package or plugins.remove_package method with a malicious package name payload. The public proof-of-concept describes injecting shell metacharacters into the package_name field to run arbitrary commands. See the GitHub CVE Documentation and the VulDB CVE Report for exploit specifics.
Detection Methods for CVE-2026-18612
Indicators of Compromise
- HTTP POST requests to /cgi-bin/glc referencing the plugins.install_package or plugins.remove_package methods with shell metacharacters in the package_name parameter
- Unexpected child processes spawned by the router's CGI handler, such as sh, wget, curl, nc, or busybox invocations
- Outbound connections from the router to unknown hosts shortly after plugin management requests
- New or modified files under /tmp, /etc, or plugin directories on the device
Detection Strategies
- Inspect router or upstream firewall logs for HTTP traffic to /cgi-bin/glc containing suspicious characters (;, |, `, $(, &&) in JSON bodies or query parameters
- Alert on repeated 200-status responses to /cgi-bin/glc from external IP ranges, which should not typically reach the management interface
- Correlate router-originated DNS lookups or outbound sessions against threat intelligence feeds
Monitoring Recommendations
- Forward router syslog and NetFlow data to a centralized SIEM for behavior baselining
- Track configuration and firmware version drift across managed GL-iNet fleets
- Monitor for unauthorized administrative sessions and plugin state changes on affected devices
How to Mitigate CVE-2026-18612
Immediate Actions Required
- Restrict access to the router administration interface and the /cgi-bin/glc endpoint to trusted management networks only
- Disable remote management (WAN-side admin access) on all GL-MT3000 devices until a patched firmware is applied
- Rotate administrative credentials and audit installed plugins for unexpected packages
- Isolate affected devices from sensitive network segments while remediation is in progress
Patch Information
At the time of publication, no fixed firmware version is listed in the NVD entry. Operators should monitor the GL-iNet security advisories and the VulDB Vulnerability Record for firmware releases beyond 4.4.5 that address the command injection in plugins.so.
Workarounds
- Block external access to TCP ports serving the router's web UI at the perimeter firewall
- Place the router management VLAN behind a jump host requiring multi-factor authentication
- Deploy network segmentation so that a compromised router cannot reach production or identity infrastructure
- Remove or disable the plugin management functionality where the deployment does not require it
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
