CVE-2026-18684: GL.iNet GL-MT3000 RCE Vulnerability

CVE-2026-18684 Overview

CVE-2026-18684 is a command injection vulnerability affecting GL.iNet GL-MT3000 routers running firmware versions up to 4.4.5. The flaw resides in the remove_profile function within the modem.so component, reachable through the /cgi-bin/glc endpoint. Attackers can manipulate input to this function to inject arbitrary operating system commands. The vulnerability is exploitable remotely without authentication or user interaction. A public proof-of-concept exploit has been published, increasing the likelihood of opportunistic attacks against exposed devices. The vendor was contacted early in the disclosure process and confirmed the existence of the vulnerability.

Critical Impact
Unauthenticated remote attackers can execute arbitrary commands on affected GL-MT3000 routers, resulting in full device compromise and pivot opportunities into connected networks.

Affected Products

GL.iNet GL-MT3000 firmware versions up to and including 4.4.5
Vulnerable component: modem.so loaded by /cgi-bin/glc
Affected function: remove_profile

Discovery Timeline

2026-08-03 - CVE-2026-18684 published to NVD
2026-08-04 - Last updated in NVD database

Technical Details for CVE-2026-18684

Vulnerability Analysis

The vulnerability is classified under [CWE-74] Improper Neutralization of Special Elements in Output Used by a Downstream Component. It affects the remove_profile handler exposed through the /cgi-bin/glc CGI interface on the GL-MT3000 travel router. The handler accepts user-supplied profile identifiers and passes them into a downstream shell context without sufficient sanitization. Because the endpoint is reachable over the network and requires no authentication, an attacker on the LAN or a device exposed to the internet can trigger the injection with a single HTTP request. Successful exploitation yields command execution with the privileges of the CGI process, which on GL.iNet devices typically runs as root. The EPSS score of 2.028% (79th percentile) reflects elevated exploitation probability driven by the public proof of concept.

Root Cause

The root cause is unsafe concatenation of untrusted input into a shell command inside the remove_profile function of modem.so. Input passed through the glc CGI endpoint is not filtered for shell metacharacters such as backticks, semicolons, or $() substitution before being executed by a system shell.

Attack Vector

Exploitation requires network access to the router's web management interface. An attacker sends a crafted HTTP request to /cgi-bin/glc invoking the remove_profile action with a malicious profile identifier containing shell metacharacters. The injected payload is executed by the underlying shell, giving the attacker arbitrary command execution. A working proof of concept is available in a public GitHub repository.

No verified exploit code is reproduced here. Refer to the VulDB vulnerability report for additional technical context.

Detection Methods for CVE-2026-18684

Indicators of Compromise

Unexpected HTTP POST requests to /cgi-bin/glc referencing the remove_profile action, especially containing shell metacharacters (;, |, `, $() in parameter values.
New or unknown processes spawned by the router's web server or modem.so handler.
Outbound connections from the router to unfamiliar hosts, which may indicate reverse shell activity.
Unauthorized changes to router configuration, firewall rules, or DNS settings.

Detection Strategies

Inspect router HTTP access logs for requests to /cgi-bin/glc containing suspicious characters or unusually long parameter values.
Monitor network traffic for HTTP requests targeting GL.iNet management endpoints from untrusted sources.
Compare firmware and configuration hashes against a known-good baseline to identify tampering.

Monitoring Recommendations

Forward router syslog output to a centralized logging or SIEM platform for correlation and retention.
Alert on management-interface requests originating from WAN-side addresses.
Track process execution telemetry from adjacent monitored hosts for signs of pivoting from a compromised router.

How to Mitigate CVE-2026-18684

Immediate Actions Required

Restrict access to the router's web administration interface to trusted management VLANs; block WAN-side exposure of /cgi-bin/glc.
Disable remote administration features unless strictly required.
Audit connected devices and configuration for unauthorized changes.
Rotate administrative credentials and any secrets stored on the device.

Patch Information

At time of publication, no fixed firmware version is referenced in the NVD entry. Monitor the GL.iNet firmware download portal and vendor advisories for a release addressing the remove_profile command injection in modem.so. Apply the update to all GL-MT3000 devices running firmware 4.4.5 or earlier as soon as it becomes available.

Workarounds

Place the router behind an upstream firewall that blocks inbound access to TCP ports serving the web UI from untrusted networks.
Segment IoT and management networks so that a compromised router cannot reach sensitive internal assets.
Where feasible, temporarily replace affected units with unaffected hardware until a patched firmware release is available.

bash

# Example: block WAN access to the router management interface using iptables
iptables -I INPUT -i wan -p tcp --dport 80 -j DROP
iptables -I INPUT -i wan -p tcp --dport 443 -j DROP