CVE-2026-18686: GL.iNet GL-MT3000 RCE Vulnerability

CVE-2026-18686 Overview

CVE-2026-18686 is a command injection vulnerability in the GL.iNet GL-MT3000 router affecting firmware versions up to 4.4.5. The flaw resides in the nas-web.add_user function within the /cgi-bin/glc endpoint, part of the nas-web RPC Wrapper component. Attackers can inject arbitrary operating system commands remotely without authentication or user interaction. The vendor confirmed the vulnerability after early disclosure, and a public proof-of-concept is available on GitHub. The weakness maps to [CWE-74] (Improper Neutralization of Special Elements in Output Used by a Downstream Component). The EPSS score is 2.607% at the 83.9 percentile, indicating elevated exploitation probability relative to most CVEs.

Critical Impact
Unauthenticated remote attackers can execute arbitrary OS commands on affected GL-MT3000 routers, leading to full device compromise and potential pivoting into the internal network.

Affected Products

GL.iNet GL-MT3000 firmware versions up to and including 4.4.5
nas-web RPC Wrapper component (/cgi-bin/glc)
nas-web.add_user RPC function

Discovery Timeline

2026-08-04 - CVE-2026-18686 published to NVD
2026-08-04 - Last updated in NVD database

Technical Details for CVE-2026-18686

Vulnerability Analysis

The vulnerability exists in the nas-web.add_user RPC handler exposed through the /cgi-bin/glc interface on the GL-MT3000 router. This endpoint is part of the Network Attached Storage (NAS) management functionality that allows administrators to create user accounts for shared storage access. The handler passes user-supplied parameters into a shell context without proper neutralization of shell metacharacters. Attackers can supply crafted input that breaks out of the intended argument and executes arbitrary commands with the privileges of the web service, typically root on embedded router firmware. A public proof-of-concept demonstrating the ADD_USER and ADD_SHARE attack paths is hosted in an IoT vulnerability research repository on GitHub.

Root Cause

The root cause is improper neutralization of special elements passed to a downstream shell interpreter, classified as [CWE-74]. The nas-web.add_user function concatenates attacker-controlled RPC parameters into a system command string without input validation, escaping, or use of safe parameterized APIs. Shell metacharacters such as backticks, semicolons, pipes, and command substitution sequences are interpreted by the underlying shell instead of being treated as literal data.

Attack Vector

Exploitation requires only network access to the router's web management interface. The attacker sends a crafted RPC request to /cgi-bin/glc invoking the nas-web.add_user method with a malicious payload embedded in a user-controlled field. No authentication or user interaction is required. Because GL-MT3000 devices are frequently deployed as travel and small-office routers, exposed management interfaces on local networks or misconfigured WAN interfaces significantly expand the attack surface.

No verified exploit code is reproduced here. Technical details and a proof-of-concept are published in the IoT Vulnerability Research repository on GitHub and the VulDB entry for CVE-2026-18686.

Detection Methods for CVE-2026-18686

Indicators of Compromise

HTTP POST requests to /cgi-bin/glc invoking the nas-web.add_user method containing shell metacharacters such as ;, |, &&, $(), or backticks in user-supplied fields.
Unexpected child processes spawned by the router's web server or nas-web daemon, particularly sh, busybox, wget, curl, or nc.
New or unexpected user accounts, cron entries, or startup scripts on the router filesystem.
Outbound connections from the router to untrusted hosts shortly after NAS management requests.

Detection Strategies

Inspect web server and nas-web application logs on the router for requests to /cgi-bin/glc with anomalous payloads targeting add_user or add_share.
Monitor network traffic for HTTP requests to router management interfaces containing shell injection patterns.
Baseline expected process trees on the router and alert on deviations, especially shell interpreters spawned from web service parents.

Monitoring Recommendations

Forward router syslog and access logs to a centralized SIEM for correlation and retention.
Monitor for firmware version 4.4.5 or earlier on GL-MT3000 devices across the environment.
Alert on any router management interface exposed to untrusted network segments or the public internet.

How to Mitigate CVE-2026-18686

Immediate Actions Required

Restrict access to the GL-MT3000 web management interface to trusted management VLANs and block WAN-side access.
Disable the NAS feature on affected devices if it is not required for business operations.
Inventory all GL.iNet GL-MT3000 devices and identify those running firmware 4.4.5 or earlier.
Review router configurations, user accounts, and scheduled tasks for signs of tampering.

Patch Information

At the time of publication, no fixed firmware version is referenced in the NVD entry. Monitor the GL.iNet download portal and the VulDB entry for CVE-2026-18686 for updated firmware releases addressing the nas-web.add_user command injection. Apply vendor updates to all GL-MT3000 devices as soon as they become available.

Workarounds

Place affected routers behind a firewall that restricts access to the management interface by source IP.
Disable the nas-web service or unmount the NAS share until a patched firmware is available.
Segment IoT and router management networks from user and server networks to limit blast radius.
Rotate any credentials stored on or accessible from the router after applying patches.

bash

# Configuration example: restrict management interface via iptables on the router
# Allow management access only from a trusted subnet (192.0.2.0/24)
iptables -I INPUT -p tcp --dport 80  -s 192.0.2.0/24 -j ACCEPT
iptables -I INPUT -p tcp --dport 443 -s 192.0.2.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 80  -j DROP
iptables -A INPUT -p tcp --dport 443 -j DROP