CVE-2026-26793: GL-iNet GL-AR300M16 RCE Vulnerability

CVE-2026-26793 Overview

GL-iNet GL-AR300M16 v4.3.11 was discovered to contain a command injection vulnerability via the set_config function. This vulnerability allows attackers to execute arbitrary commands via a crafted input, potentially leading to complete device compromise.

Critical Impact

Network-accessible command injection vulnerability in GL-iNet router firmware allows unauthenticated attackers to execute arbitrary system commands, potentially leading to full device takeover, network compromise, and lateral movement within affected networks.

Affected Products

• GL-iNet GL-AR300M16 firmware version 4.3.11

Discovery Timeline

• 2026-03-12 - CVE CVE-2026-26793 published to NVD
• 2026-03-12 - Last updated in NVD database

Technical Details for CVE-2026-26793

Vulnerability Analysis

This command injection vulnerability (CWE-77) exists within the set_config function of the GL-iNet GL-AR300M16 router firmware. The vulnerability allows remote attackers to inject and execute arbitrary operating system commands without authentication. The attack can be performed over the network with no user interaction required, making it particularly dangerous for internet-exposed devices.

The underlying issue stems from improper neutralization of special elements used in command construction. When processing configuration requests, the set_config function fails to adequately sanitize user-supplied input before passing it to system shell commands, enabling attackers to break out of the intended command context and execute arbitrary code with the privileges of the web service process.

Root Cause

The root cause is improper input validation in the set_config function. The firmware fails to sanitize or escape shell metacharacters (such as ;, |, &, $(), and backticks) from user-controlled input before incorporating it into system commands. This allows attackers to terminate the intended command and append additional malicious commands that execute with elevated privileges on the underlying Linux-based operating system.

Attack Vector

The attack vector is network-based, requiring no authentication or user interaction. An attacker can exploit this vulnerability by sending specially crafted HTTP requests to the device's web interface. The malicious payload is injected through parameters processed by the set_config function.

The exploitation process typically involves:

1. Identifying an internet-exposed or locally accessible GL-AR300M16 device
2. Crafting a malicious HTTP request containing shell metacharacters and commands
3. Sending the request to the vulnerable set_config endpoint
4. The injected commands execute with the privileges of the web server process

For technical details and proof-of-concept information, see the GitHub PoC Repository.

Detection Methods for CVE-2026-26793

Indicators of Compromise

• Unexpected outbound network connections from the router device
• Unusual processes running on the device (visible via SSH if accessible)
• Modified configuration files or unauthorized changes to device settings
• Presence of suspicious files in /tmp or other writable directories
• Unexpected DNS queries or network traffic patterns originating from the router

Detection Strategies

• Monitor web server logs for requests containing shell metacharacters (;, |, &, $(, `) in configuration parameters
• Implement network-level intrusion detection rules to identify exploitation attempts targeting the set_config endpoint
• Deploy behavioral monitoring to detect unusual process execution on IoT devices
• Utilize network traffic analysis to identify command-and-control communications or data exfiltration

Monitoring Recommendations

• Enable and regularly review device access logs for suspicious activity
• Implement network segmentation to isolate IoT devices from critical infrastructure
• Deploy network monitoring solutions capable of inspecting HTTP traffic to embedded devices
• Configure alerting for any administrative access attempts from unexpected IP addresses

How to Mitigate CVE-2026-26793

Immediate Actions Required

• Isolate affected GL-AR300M16 devices from untrusted networks immediately
• Disable remote management interfaces if not required
• Implement network segmentation to limit exposure of vulnerable devices
• Monitor for indicators of compromise on potentially affected systems
• Review device logs for evidence of exploitation attempts

Patch Information

At the time of publication, no official patch information is available from GL-iNet. Organizations should monitor the GL-iNet official website and support channels for firmware updates addressing this vulnerability. Contact GL-iNet support directly for remediation guidance.

Workarounds

• Disable the web management interface if not required for operations
• Restrict access to the device's management interface using firewall rules to allow only trusted IP addresses
• Place vulnerable devices behind a VPN and disable direct internet exposure
• Implement strict network access controls to limit who can reach the device's administrative interfaces
• Consider temporarily replacing affected devices with alternative hardware until a patch is available

# Example: Restrict management interface access via firewall (device-specific commands may vary)
# Block external access to web interface (port 80/443)
iptables -A INPUT -p tcp --dport 80 -s ! 192.168.1.0/24 -j DROP
iptables -A INPUT -p tcp --dport 443 -s ! 192.168.1.0/24 -j DROP