CVE-2026-26794: GL-iNet GL-AR300M16 SQLi Vulnerability

CVE-2026-26794 Overview

CVE-2026-26794 is a SQL injection vulnerability discovered in GL-iNet GL-AR300M16 router firmware version 4.3.11. The vulnerability exists in the add_group() function, which fails to properly sanitize user-supplied input before incorporating it into SQL queries. This allows attackers to execute arbitrary SQL database operations through specially crafted HTTP requests, potentially compromising the integrity and confidentiality of the device's stored data.

Critical Impact

Attackers can leverage this SQL injection vulnerability to manipulate database contents, extract sensitive configuration data, bypass authentication mechanisms, or potentially escalate their access to the underlying router system.

Affected Products

• GL-iNet GL-AR300M16 firmware version 4.3.11

Discovery Timeline

• 2026-03-12 - CVE-2026-26794 published to NVD
• 2026-03-12 - Last updated in NVD database

Technical Details for CVE-2026-26794

Vulnerability Analysis

This SQL injection vulnerability affects the GL-iNet GL-AR300M16 portable router, a device commonly deployed in IoT environments for providing network connectivity. The vulnerable add_group() function is part of the device's web management interface and handles access control list (ACL) group management operations.

The vulnerability stems from insufficient input validation in the HTTP request handler. When processing requests to add new ACL groups, the function directly incorporates user-supplied parameters into SQL queries without proper sanitization or parameterized query usage. This classic SQL injection pattern allows attackers to break out of the intended query structure and inject malicious SQL statements.

Given that this affects IoT network infrastructure, successful exploitation could have cascading effects on network security, potentially allowing attackers to pivot to other connected devices or intercept network traffic.

Root Cause

The root cause of CVE-2026-26794 is improper input validation in the add_group() function. The function constructs SQL queries using string concatenation with unsanitized user input from HTTP request parameters, rather than using parameterized queries or prepared statements. This allows malicious SQL syntax to be interpreted as part of the query structure.

Attack Vector

An attacker can exploit this vulnerability by sending a maliciously crafted HTTP request to the router's web management interface. The attack targets the endpoint associated with the add_group() function, injecting SQL syntax through vulnerable parameters. The attack can be conducted remotely if the management interface is exposed to the network, or locally if the attacker has access to the internal network where the router operates.

The exploitation process involves:

1. Identifying the vulnerable HTTP endpoint for group management
2. Crafting a malicious HTTP request containing SQL injection payloads in the relevant parameters
3. Sending the request to the target device
4. The injected SQL is executed against the device's database, allowing data extraction, modification, or authentication bypass

For detailed technical information about this vulnerability, refer to the GitHub IoT Vulnerability Repository.

Detection Methods for CVE-2026-26794

Indicators of Compromise

• Unusual HTTP requests to the router's ACL management endpoints containing SQL metacharacters such as single quotes, semicolons, or UNION statements
• Unexpected database queries or errors in device logs
• Modifications to ACL group configurations that were not authorized by administrators
• Authentication anomalies or unauthorized access to the router management interface

Detection Strategies

• Monitor HTTP traffic to GL-iNet router management interfaces for SQL injection patterns in request parameters
• Implement web application firewall (WAF) rules to detect and block common SQL injection payloads targeting the add_group() endpoint
• Deploy network-based intrusion detection systems (IDS) with signatures for SQL injection attacks against IoT devices
• Enable and review detailed logging on GL-iNet routers to identify suspicious API calls

Monitoring Recommendations

• Audit firmware versions across all GL-iNet GL-AR300M16 devices in your environment and flag those running version 4.3.11
• Implement continuous monitoring of router management interface access logs
• Set up alerts for multiple failed authentication attempts or unusual administrative actions
• Monitor network traffic for anomalous patterns indicating potential exploitation attempts

How to Mitigate CVE-2026-26794

Immediate Actions Required

• Check if your GL-iNet GL-AR300M16 routers are running the vulnerable firmware version 4.3.11
• Restrict access to the router's web management interface to trusted IP addresses only
• Place affected routers behind additional network security controls until patching is possible
• Disable remote management if not required and limit access to local connections only

Patch Information

At the time of publication, no official patch information has been provided by GL-iNet. Users should monitor the GL-iNet official website and security advisories for firmware updates addressing this vulnerability. When an update becomes available, apply it immediately following proper change management procedures.

Additional technical details are available in the GitHub IoT Vulnerability Repository.

Workarounds

• Implement network segmentation to isolate affected routers from critical network segments
• Use firewall rules to restrict access to the management interface to specific trusted IP addresses or management VLANs
• Deploy a web application firewall in front of the device management interface to filter SQL injection attempts
• Disable the web management interface entirely if it is not required for device administration, using alternative management methods where available

# Example firewall rule to restrict management interface access (adjust for your environment)
# Restrict access to GL-iNet management interface (typically port 80/443) to management VLAN only
iptables -A INPUT -p tcp --dport 80 -s 192.168.100.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 80 -j DROP
iptables -A INPUT -p tcp --dport 443 -s 192.168.100.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 443 -j DROP