CVE-2026-26791: GL-iNet AR300M16 Firmware RCE Flaw

CVE-2026-26791 Overview

CVE-2026-26791 is a command injection vulnerability in the GL-iNet GL-AR300M16 router running firmware version 4.3.11. The flaw resides in the enable_echo_server function, which fails to sanitize the port string parameter before passing it to a shell context. Attackers can send a crafted request to execute arbitrary operating system commands on the device. The vulnerability is network-accessible, requires no authentication, and no user interaction. Successful exploitation grants full control over the affected router, exposing the local network to pivoting, traffic interception, and persistent compromise.

Critical Impact

Unauthenticated remote attackers can execute arbitrary commands on affected GL-AR300M16 routers, leading to full device takeover and network compromise.

Affected Products

• GL-iNet GL-AR300M16 hardware
• GL-iNet GL-AR300M16 firmware version 4.3.11
• Deployments exposing the vulnerable enable_echo_server endpoint

Discovery Timeline

• 2026-03-12 - CVE-2026-26791 published to NVD
• 2026-03-16 - Last updated in NVD database

Technical Details for CVE-2026-26791

Vulnerability Analysis

The vulnerability is categorized as Command Injection under [CWE-77], Improper Neutralization of Special Elements used in a Command. The GL-AR300M16 firmware exposes an enable_echo_server function that accepts a port parameter as a string. The function passes this string into a shell command without proper neutralization of metacharacters such as ;, |, &, and backticks. An attacker who supplies a crafted port value can break out of the intended command context and append arbitrary shell commands.

Because the function executes within the router's management process, injected commands typically run with elevated privileges. This allows attackers to read configuration files, modify firewall rules, install persistent backdoors, or use the router as a pivot point into the internal network. The attack requires no authentication and can be triggered remotely if the management interface is reachable.

Root Cause

The root cause is missing input validation and sanitization on the port parameter before it is concatenated into a shell command string. The firmware treats user-supplied input as trusted data and passes it directly to a system call, violating secure coding practices for command construction.

Attack Vector

Exploitation occurs over the network against the router's web or API interface that invokes enable_echo_server. The attacker submits a crafted HTTP request containing shell metacharacters within the port field. Technical reproduction details are available in the GitHub IoT Vulnerability PoC repository.

Detection Methods for CVE-2026-26791

Indicators of Compromise

• HTTP requests targeting the enable_echo_server endpoint containing shell metacharacters such as ;, |, &, $(), or backticks in the port parameter
• Unexpected child processes spawned from the router's web management daemon
• New or modified entries in /etc/rc.local, crontab, or firewall configuration on the device
• Outbound connections from the router to unfamiliar IP addresses or command-and-control infrastructure

Detection Strategies

• Inspect web server and management interface logs for non-numeric values submitted as the port parameter
• Deploy network IDS signatures that flag HTTP requests carrying shell injection payloads to GL-iNet management endpoints
• Monitor for unauthorized firmware configuration changes or new services binding to unusual ports on the router

Monitoring Recommendations

• Capture and review router syslog output for unexpected command execution and process creation events
• Alert on management interface access originating from untrusted networks or geographies
• Track DNS and outbound traffic from the router for indicators of beaconing or data exfiltration

How to Mitigate CVE-2026-26791

Immediate Actions Required

• Restrict access to the router's management interface so it is reachable only from trusted internal hosts
• Disable WAN-side administration and any exposed API endpoints invoking enable_echo_server
• Audit the device for signs of prior compromise, including unauthorized accounts, persistence mechanisms, and altered firewall rules
• Apply firmware updates from GL-iNet once a patched version newer than 4.3.11 is released

Patch Information

No vendor advisory or fixed firmware version is referenced in the NVD entry at the time of publication. Administrators should monitor the GL-iNet download portal for firmware releases superseding version 4.3.11 that address the enable_echo_server input handling.

Workarounds

• Block external access to the router's HTTP/HTTPS management ports using upstream firewall rules
• Place affected routers behind a segmented management VLAN with strict access control lists
• If the echo server feature is not required, disable it through the router configuration to remove the attack surface

# Example iptables rules to restrict management access to a trusted subnet
iptables -A INPUT -p tcp --dport 80 -s 10.0.0.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 443 -s 10.0.0.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 80 -j DROP
iptables -A INPUT -p tcp --dport 443 -j DROP