CVE-2026-18614: GL-iNet GL-MT3000 RCE Vulnerability

CVE-2026-18614 Overview

CVE-2026-18614 is a command injection vulnerability affecting GL-iNet GL-MT3000 routers running firmware up to version 4.4.5. The flaw resides in the s2s.enable_echo_server function of the /cgi-bin/glc endpoint within the s2s.so native plugin. An attacker can manipulate the port argument to inject and execute arbitrary operating system commands. The attack is initiated remotely over the network and requires no authentication or user interaction. A public exploit has been released, increasing the likelihood of opportunistic scanning and abuse against exposed devices.

Critical Impact
Unauthenticated remote attackers can achieve arbitrary command execution on affected GL-iNet GL-MT3000 routers, leading to full device compromise and network pivoting.

Affected Products

GL-iNet GL-MT3000 firmware versions up to and including 4.4.5
s2s.so native plugin component
/cgi-bin/glc CGI endpoint

Discovery Timeline

2026-08-03 - CVE-2026-18614 published to NVD
2026-08-03 - Last updated in NVD database

Technical Details for CVE-2026-18614

Vulnerability Analysis

The vulnerability is classified under [CWE-74: Improper Neutralization of Special Elements in Output Used by a Downstream Component (Injection)]. The s2s.enable_echo_server function in the s2s.so native plugin accepts a port argument through the /cgi-bin/glc CGI interface. The value is passed into a downstream command interpreter without adequate sanitization. Attackers can append shell metacharacters to the port parameter to break out of the intended command context and execute arbitrary shell commands with the privileges of the CGI process, typically root on embedded routers.

Because the network is the attack vector and no privileges or user interaction are required, exposed management interfaces are directly reachable by remote adversaries. A public proof of concept is available on GitHub, and the EPSS score of 2.011% (78.97 percentile) reflects elevated exploitation likelihood relative to average CVEs.

Root Cause

The root cause is improper neutralization of user-supplied input passed to a system command execution routine. The port argument is concatenated into a command string without input validation, allow-listing, or safe execution APIs that separate command and arguments.

Attack Vector

An attacker sends a crafted HTTP request to the /cgi-bin/glc endpoint invoking s2s.enable_echo_server with a malicious port parameter. Shell metacharacters such as ;, |, backticks, or $() embedded in the value are interpreted by the underlying shell, resulting in arbitrary command execution. Refer to the GitHub CVE Documentation and the VulDB Vulnerability Details for the technical write-up and reproduction steps.

Detection Methods for CVE-2026-18614

Indicators of Compromise

HTTP requests to /cgi-bin/glc containing s2s.enable_echo_server with shell metacharacters (;, |, &, backticks, $()) in the port parameter.
Unexpected child processes spawned by the router web server (lighttpd, uhttpd, or the glc CGI binary) executing shells such as /bin/sh or /bin/ash.
Outbound connections from the router to unknown hosts shortly after HTTP activity on the management interface.

Detection Strategies

Inspect web server access logs for requests to /cgi-bin/glc referencing s2s.enable_echo_server and flag non-numeric or metacharacter-laden port values.
Deploy network intrusion detection signatures that match command injection patterns in HTTP query strings and POST bodies targeting the affected endpoint.
Baseline normal process trees on GL-iNet devices and alert on shell processes descending from CGI handlers.

Monitoring Recommendations

Forward router syslog and HTTP access logs to a centralized SIEM for correlation with network telemetry.
Monitor for new persistence artifacts on the device such as modified rc.local, cron entries, or unexpected listening sockets.
Track egress traffic from router management VLANs to detect data staging or command-and-control activity.

How to Mitigate CVE-2026-18614

Immediate Actions Required

Restrict access to the router administrative interface to trusted management networks only, blocking WAN-side exposure.
Disable remote administration and any UPnP or port-forwarding rules that expose /cgi-bin/glc to untrusted networks.
Audit devices for signs of compromise using the indicators listed above before applying updates.

Patch Information

At the time of publication, no fixed firmware version is referenced in the enriched CVE data. GL-iNet was contacted about this disclosure and confirmed the vulnerability. Administrators should consult the VulDB CVE Entry and the GL-iNet vendor site for firmware releases addressing versions after 4.4.5, and apply updates as soon as they become available.

Workarounds

Place affected routers behind an upstream firewall that blocks external access to TCP management ports.
Segment the router management plane onto an isolated VLAN accessible only via VPN or jump host.
If the s2s service is not required, disable it or block requests to the /cgi-bin/glc path at an upstream proxy or firewall.

bash

# Example: block external access to the affected CGI endpoint at an upstream firewall
# (adjust interface and source ranges to match your environment)
iptables -I FORWARD -p tcp -d <router_ip> --dport 80 -m string \
    --string "/cgi-bin/glc" --algo bm -j DROP
iptables -I FORWARD -p tcp -d <router_ip> --dport 443 -m string \
    --string "/cgi-bin/glc" --algo bm -j DROP