CVE-2026-18685 Overview
CVE-2026-18685 is a command injection vulnerability in GL.iNet GL-MT3000 travel routers running firmware versions up to 4.4.5. The flaw resides in the set_upgrade function of the /cgi-bin/glc endpoint within the modem.so component. Attackers can inject arbitrary operating system commands through unsanitized input passed to this function. Exploitation is possible remotely over the network without authentication or user interaction. The vendor has confirmed the vulnerability and a public proof-of-concept has been disclosed, increasing the likelihood of active exploitation attempts against exposed devices.
Critical Impact
Remote, unauthenticated attackers can execute arbitrary commands on affected GL-MT3000 routers, leading to full device compromise and lateral movement into connected networks.
Affected Products
- GL.iNet GL-MT3000 firmware versions up to and including 4.4.5
- The modem.so component exposed via /cgi-bin/glc
- The set_upgrade handler function
Discovery Timeline
- 2026-08-04 - CVE-2026-18685 published to the National Vulnerability Database
- 2026-08-04 - Last updated in NVD database
Technical Details for CVE-2026-18685
Vulnerability Analysis
The vulnerability is classified under [CWE-74] as improper neutralization of special elements in output used by a downstream component. The set_upgrade function in the modem.so shared library, invoked through the /cgi-bin/glc interface, passes attacker-controlled input into a shell context without sanitization. This allows an attacker to append or inject shell metacharacters that the system interprets as additional commands.
Exploitation requires only network reachability to the router's web management interface. Because the /cgi-bin/glc handler processes the request before enforcing authentication for the affected code path, an unauthenticated attacker can trigger command execution as the web service user, which typically runs with elevated privileges on embedded OpenWrt-based devices.
Root Cause
The root cause is unsafe construction of a shell command string inside the set_upgrade handler. User-supplied parameters intended to identify firmware upgrade sources are concatenated directly into a command executed by the router's shell. No input validation, allow-listing, or safe API invocation (such as execve with argument arrays) is present.
Attack Vector
The attack vector is network-based over HTTP or HTTPS to the router's management interface. An attacker crafts a request to /cgi-bin/glc invoking the set_upgrade action with a payload containing shell metacharacters. Refer to the GitHub PoC Repository and VulDB CVE-2026-18685 for technical reproduction details.
// No verified exploit code is reproduced here.
// See the linked PoC repository for the payload structure targeting
// the set_upgrade action of /cgi-bin/glc.
Detection Methods for CVE-2026-18685
Indicators of Compromise
- HTTP requests to /cgi-bin/glc containing shell metacharacters such as ;, |, &, backticks, or $() in parameters passed to the set_upgrade action
- Unexpected outbound connections from the router to attacker-controlled infrastructure following administrative requests
- New or modified files in persistence locations such as /etc/rc.local, /etc/init.d/, or /tmp on the device
- Anomalous child processes spawned by the uhttpd or lighttpd web service handling /cgi-bin/glc
Detection Strategies
- Inspect router access logs for POST or GET requests targeting /cgi-bin/glc with the set_upgrade parameter and payloads containing command separators
- Deploy network intrusion detection signatures that flag HTTP requests to cgi-bin/glc containing URL-encoded shell metacharacters
- Baseline outbound traffic from router management interfaces and alert on deviations, particularly connections to non-vendor domains
Monitoring Recommendations
- Forward router syslog data to a centralized logging platform and retain HTTP access logs for the management interface
- Monitor firmware integrity by comparing installed package hashes against vendor-published values
- Track administrative interface exposure by scanning perimeter IPs for the GL.iNet management UI reachable from untrusted networks
How to Mitigate CVE-2026-18685
Immediate Actions Required
- Restrict access to the router web management interface to trusted management VLANs or specific administrator IP addresses
- Disable remote WAN-side administration on GL-MT3000 devices until a fixed firmware release is applied
- Audit connected devices and network segments for signs of lateral movement originating from the router
- Rotate any credentials, VPN keys, and Wi-Fi PSKs stored on affected devices after remediation
Patch Information
As of publication, GL.iNet has confirmed the vulnerability. Administrators should monitor the VulDB advisory for CVE-2026-18685 and the GL.iNet firmware download portal for a release superseding version 4.4.5, and apply it immediately upon availability.
Workarounds
- Place the GL-MT3000 behind an upstream firewall that blocks unsolicited inbound access to TCP ports 80 and 443 on the router
- Disable the cellular modem feature if it is not required, reducing the code paths in modem.so that can be reached
- Segment the router's LAN so that a compromised device cannot pivot to sensitive internal resources
# Example: restrict management interface to a single admin subnet on OpenWrt-based firmware
uci set firewall.@zone[0].input='DROP'
uci add firewall rule
uci set firewall.@rule[-1].name='Allow-Admin-LAN'
uci set firewall.@rule[-1].src='lan'
uci set firewall.@rule[-1].src_ip='192.0.2.0/24'
uci set firewall.@rule[-1].dest_port='80 443'
uci set firewall.@rule[-1].target='ACCEPT'
uci commit firewall
/etc/init.d/firewall restart
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
