CVE-2026-18615 Overview
CVE-2026-18615 is a command injection vulnerability affecting GL-iNet GL-MT3000 routers running firmware up to version 4.4.5. The flaw resides in the wg-server.generate_publickey function within /cgi-bin/glc, which is part of the wg-server.so native plugin. Attackers can manipulate the private_key argument to inject arbitrary operating system commands. The vulnerability is remotely exploitable over the network without authentication. The exploit has been publicly disclosed, and the vendor confirmed the issue after early notification.
Critical Impact
Unauthenticated remote attackers can execute arbitrary commands on affected GL-MT3000 devices, leading to full device compromise, traffic interception, and lateral movement into connected networks.
Affected Products
- GL-iNet GL-MT3000 firmware versions up to and including 4.4.5
- wg-server.so native plugin component
- /cgi-bin/glc CGI endpoint exposing the WireGuard server configuration interface
Discovery Timeline
- 2026-08-03 - CVE-2026-18615 published to the National Vulnerability Database
- 2026-08-03 - Last updated in NVD database
Technical Details for CVE-2026-18615
Vulnerability Analysis
The vulnerability is a command injection flaw classified under [CWE-74] (Improper Neutralization of Special Elements in Output Used by a Downstream Component). It resides in the WireGuard server management logic exposed through the router's web interface. The generate_publickey handler accepts a private_key parameter and passes it to a shell context without sanitizing metacharacters such as backticks, semicolons, or command substitution sequences. An attacker who can reach the router's HTTP interface can issue a crafted request to /cgi-bin/glc that triggers execution of injected commands with the privileges of the CGI process, typically root on GL-iNet devices.
Root Cause
The root cause is unsafe construction of a shell command using attacker-controlled input inside wg-server.so. The generate_publickey routine is designed to derive a WireGuard public key from a supplied private key by invoking an external binary. Because the private key value is concatenated into the command string rather than passed as an isolated argument, shell metacharacters break out of the intended parameter context and execute additional commands.
Attack Vector
Exploitation requires only network reachability to the router's management interface. No authentication is required according to the disclosure. An attacker sends an HTTP request to /cgi-bin/glc invoking the wg-server.generate_publickey method with a private_key value containing shell injection payloads. If the management interface is exposed to the internet or to a hostile local network segment, the attacker gains remote command execution. See the GitHub CVE Documentation and VulDB Vulnerability Details for further technical breakdown.
Detection Methods for CVE-2026-18615
Indicators of Compromise
- HTTP POST requests to /cgi-bin/glc referencing wg-server.generate_publickey with unusual characters in the private_key parameter, such as backticks, $(, ;, |, or &&.
- Unexpected child processes spawned by the router's web daemon or glc CGI process.
- Outbound connections from the router to unknown hosts shortly after WireGuard configuration requests.
- New or modified files in /tmp, /etc, or user-writable paths on the device following interactions with the WireGuard interface.
Detection Strategies
- Inspect router HTTP access logs for requests to /cgi-bin/glc containing shell metacharacters in POST bodies or query strings.
- Deploy network intrusion detection signatures that flag command injection patterns targeting the private_key parameter.
- Baseline expected process trees on the device and alert on shell processes launched by the WireGuard configuration handler.
Monitoring Recommendations
- Forward router syslog and HTTP logs to a centralized analytics platform for retention and correlation.
- Monitor egress traffic from management VLANs to detect anomalous outbound connections originating from network appliances.
- Track firmware versions across the fleet and alert when GL-MT3000 devices remain on 4.4.5 or earlier.
How to Mitigate CVE-2026-18615
Immediate Actions Required
- Restrict access to the router's web management interface so it is not reachable from untrusted networks or the internet.
- Disable the WireGuard server feature on affected GL-MT3000 devices until a patched firmware is installed.
- Rotate any credentials, pre-shared keys, and WireGuard keys that were configured on the device, assuming potential compromise.
- Review router configuration and file systems for unauthorized changes, added accounts, or persistence artifacts.
Patch Information
At the time of publication, no fixed firmware version is listed in the NVD entry. Administrators should monitor the GL-iNet download center and vendor advisories for a firmware release addressing CVE-2026-18615. Refer to the VulDB CVE Record for updates on remediation status.
Workarounds
- Bind the management interface to the LAN only and place the router behind a firewall that blocks WAN-side administrative access.
- Segment IoT and network appliances into a dedicated VLAN with strict egress filtering to limit post-exploitation impact.
- Disable unused services on the router, including the WireGuard server plugin, to reduce the attack surface.
# Example: block external access to the router management interface using upstream firewall rules
iptables -A FORWARD -p tcp -d <router_ip> --dport 80 -j DROP
iptables -A FORWARD -p tcp -d <router_ip> --dport 443 -j DROP
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
