CVE-2026-18616: GL-iNet GL-MT3000 RCE Vulnerability

CVE-2026-18616 Overview

CVE-2026-18616 is a command injection vulnerability in the GL-iNet GL-MT3000 router firmware up to version 4.4.5. The flaw resides in the server.set_peer function of the /cgi-bin/glc endpoint within the wg-server.so native plugin. Attackers can manipulate the public_key argument to inject arbitrary operating system commands. Remote exploitation is possible without authentication or user interaction. The vendor confirmed the vulnerability after early disclosure, and a public exploit is available. This weakness maps to [CWE-74] (Improper Neutralization of Special Elements in Output Used by a Downstream Component).

Critical Impact
Unauthenticated remote attackers can execute arbitrary commands on affected GL-MT3000 routers via a crafted public_key value, leading to full device compromise.

Affected Products

GL-iNet GL-MT3000 firmware versions up to and including 4.4.5
Component: wg-server.so native plugin
Endpoint: /cgi-bin/glc handler for server.set_peer

Discovery Timeline

2026-08-03 - CVE-2026-18616 published to NVD
2026-08-04 - Last updated in NVD database

Technical Details for CVE-2026-18616

Vulnerability Analysis

The vulnerability affects the WireGuard server management interface exposed through the glc CGI binary on the GL-MT3000 router. When a client invokes the server.set_peer method, the wg-server.so plugin processes the caller-supplied public_key argument and passes it into a downstream shell context without adequate neutralization of shell metacharacters. An attacker who submits a public_key value containing command separators or command substitution syntax can break out of the intended argument context and execute arbitrary commands.

Because the CGI endpoint is reachable over the network and the vulnerable code path does not enforce authentication in vulnerable configurations, exploitation requires no credentials and no user interaction. Successful attacks yield code execution in the process context of the router's management daemon, which typically runs with elevated privileges on embedded Linux devices. This exposes the device configuration, VPN keys, connected clients, and the underlying network to the attacker.

Root Cause

The root cause is improper neutralization of special elements ([CWE-74]) in the public_key parameter before it is concatenated into a command string executed by a system shell. The wg-server.so plugin trusts caller-controlled input intended to represent a WireGuard base64 public key and does not restrict input to the expected character set.

Attack Vector

Exploitation is network-based. An attacker sends a crafted HTTP request to the /cgi-bin/glc endpoint invoking the server.set_peer method with a malicious public_key payload embedding shell metacharacters. Technical details and a proof-of-concept are documented in the GitHub CVE writeup and the VulDB entry.

Detection Methods for CVE-2026-18616

Indicators of Compromise

HTTP POST requests to /cgi-bin/glc invoking the server.set_peer method with non-base64 characters in the public_key field.
Unexpected child processes spawned by the router's CGI or wg-server management process, such as sh, wget, curl, busybox, or nc.
Outbound connections from the router to unknown hosts shortly after receiving set_peer requests.
New or modified WireGuard peer entries containing shell metacharacters (;, `, $(, |, &).

Detection Strategies

Inspect HTTP request bodies to /cgi-bin/glc for public_key values that deviate from the WireGuard base64 format (44 characters ending in =).
Alert on WAN-side requests to the LuCI/glc management interface, which should be restricted to LAN in default deployments.
Correlate router syslog entries showing wg-server activity with subsequent process execution or configuration changes.

Monitoring Recommendations

Forward router syslog and access logs to a central log platform for retention and query.
Baseline expected administrative sources for the router management interface and alert on deviations.
Monitor DNS queries and NetFlow originating from the router itself for signs of compromise.

How to Mitigate CVE-2026-18616

Immediate Actions Required

Restrict access to the router's management interface (/cgi-bin/glc) to trusted LAN segments only; block WAN exposure at the firewall.
Disable the WireGuard server function on GL-MT3000 devices where it is not required.
Rotate any WireGuard keys, admin passwords, and API tokens stored on affected devices, assuming potential compromise if the interface was internet-exposed.
Audit configured WireGuard peers for entries containing shell metacharacters.

Patch Information

At the time of publication, GL-iNet has confirmed the vulnerability but a fixed firmware version is not yet identified in the referenced advisories. Consult the VulDB vulnerability report and the GL-iNet security advisories page for firmware updates addressing CVE-2026-18616, and upgrade beyond version 4.4.5 as soon as a patched release is available.

Workarounds

Place the GL-MT3000 behind an upstream firewall and deny inbound access to TCP ports serving the management interface.
Bind the management daemon to LAN interfaces only and disable remote administration in the router settings.
Where WireGuard server functionality is required, front-end the router with a reverse proxy that enforces strict base64 validation on public_key parameters.

bash

# Example iptables rules to restrict management access to LAN only
iptables -A INPUT -i eth0 -p tcp --dport 80 -j DROP
iptables -A INPUT -i eth0 -p tcp --dport 443 -j DROP
iptables -A INPUT -i br-lan -p tcp --dport 80 -j ACCEPT
iptables -A INPUT -i br-lan -p tcp --dport 443 -j ACCEPT