CVE-2026-18613: GL-iNet GL-MT3000 RCE Vulnerability

CVE-2026-18613 Overview

CVE-2026-18613 is a remote injection vulnerability affecting GL-iNet GL-MT3000 routers running firmware versions up to 4.4.5. The flaw resides in the plugins.set_config function within the /cgi-bin/glc endpoint of the plugins.so native plugin component. Attackers can exploit this weakness remotely without authentication or user interaction. The vendor confirmed the vulnerability after early disclosure, and public exploit details have been released. The issue is categorized under [CWE-74], which covers improper neutralization of special elements in downstream components.

Critical Impact
Unauthenticated remote attackers can inject data into the router's plugin configuration, compromising confidentiality, integrity, and availability of the affected device.

Affected Products

GL-iNet GL-MT3000 firmware up to and including version 4.4.5
Component: plugins.so Native Plugin
Endpoint: /cgi-bin/glc (function plugins.set_config)

Discovery Timeline

2026-08-03 - CVE-2026-18613 published to NVD
2026-08-03 - Last updated in NVD database

Technical Details for CVE-2026-18613

Vulnerability Analysis

The vulnerability exists in how the GL-MT3000 router processes configuration requests submitted to the plugins.set_config function exposed through /cgi-bin/glc. The native plugin component plugins.so fails to properly neutralize user-controlled input before passing it to downstream processing routines. Attackers reach the vulnerable code path over the network without credentials, enabling injection attacks that can modify plugin configuration data and influence device behavior. The public disclosure of exploit details on GitHub increases the risk of opportunistic scanning against exposed devices.

Root Cause

The root cause is improper input neutralization [CWE-74] within the plugins.set_config handler. Configuration parameters submitted through the CGI endpoint are consumed by the native plugin binary without adequate sanitization or context-aware encoding. This allows crafted request data to alter the intended semantics of downstream operations, producing injection conditions inside the plugin subsystem.

Attack Vector

Exploitation requires network access to the router's management interface. An attacker sends a crafted HTTP request to /cgi-bin/glc invoking the plugins.set_config method with malicious payload values. Because the endpoint requires no authentication and no user interaction, exploitation is straightforward once the interface is reachable. Devices with management exposed to the internet or across untrusted network segments face the highest risk. Detailed exploitation notes are available in the GitHub CVE writeup and the VulDB entry for CVE-2026-18613.

Detection Methods for CVE-2026-18613

Indicators of Compromise

Unexpected HTTP POST requests to /cgi-bin/glc referencing the plugins.set_config method from untrusted source addresses.
Modifications to plugin configuration files or unexplained changes in loaded plugin behavior on GL-MT3000 devices.
Outbound connections from the router to unfamiliar hosts following inbound requests to the CGI endpoint.

Detection Strategies

Inspect web server and CGI logs on the router for requests targeting /cgi-bin/glc that include suspicious characters or unusual parameter lengths.
Correlate management-interface access with the source IP allowlist and flag any request originating outside expected administrative ranges.
Deploy network-based signatures matching known payload structures published in the VulDB vulnerability record #385533.

Monitoring Recommendations

Forward router syslog and HTTP access logs to a centralized SIEM for retention and correlation across devices.
Alert on any configuration change events emitted by the plugin subsystem outside scheduled maintenance windows.
Baseline normal administrative traffic patterns and generate detections on anomalous request volume to /cgi-bin/glc.

How to Mitigate CVE-2026-18613

Immediate Actions Required

Restrict access to the router's management interface to trusted administrative subnets only, disabling WAN-side access.
Audit the GL-MT3000 fleet to identify devices running firmware version 4.4.5 or earlier and prioritize them for remediation.
Review recent configuration change logs for signs of unauthorized plugins.set_config invocations.

Patch Information

No fixed firmware version is documented in the NVD entry at the time of publication. Monitor the GL-iNet security advisories and the VulDB submission record for the release of a patched firmware build. Apply the update to all affected GL-MT3000 devices as soon as it becomes available.

Workarounds

Block inbound access to TCP ports serving the router web management interface at upstream firewalls.
Place vulnerable devices behind a VPN and require authenticated tunnel access for administrative operations.
Disable non-essential plugins on the GL-MT3000 to reduce the attack surface exposed by the plugins.so component.

bash

# Configuration example: restrict management access via iptables on the router
iptables -I INPUT -p tcp --dport 80 -s 192.168.8.0/24 -j ACCEPT
iptables -I INPUT -p tcp --dport 80 -j DROP
iptables -I INPUT -p tcp --dport 443 -s 192.168.8.0/24 -j ACCEPT
iptables -I INPUT -p tcp --dport 443 -j DROP