GL-MT3000 CVE-2026-18600

Exploitation requires valid credentials providing at least low-privilege access to the GL-MT3000 web management interface (PR:L per CVSS 4.0 vector) - unauthenticated exploitation is not supported by the available data. The vulnerable RPC methods network.switch_info and network.switch_status must be reachable via the oui-httpd HTTP daemon, which is enabled by default on the management interface. No additional non-default configuration is required once the attacker is authenticated. Exploitation is constrained by: (1) the PR:L authentication requirement - attackers without credentials must first obtain them; (2) network reachability to the management interface - if remote management is disabled (a common GL.iNet default), an attacker must have LAN or VPN access; (3) the attack does not affect subsequent systems (SC:N/SI:N/SA:N), limiting blast radius to the router itself.

The CVSS 4.0 score of 7.4 with base vector AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H reflects a high-impact vulnerability requiring no special attack conditions and no user interaction, constrained only by the low-privilege authentication requirement (PR:L). The embedded E:P modifier confirms a public proof-of-concept exists, which meaningfully accelerates exploitation timelines. The vulnerability is not listed in the CISA KEV catalog at time of analysis, so mass active exploitation is not confirmed - this distinction matters: the threat is real but not yet demonstrably widespread. For devices with remote management enabled or that are reachable from untrusted networks, the combination of public PoC and low attack complexity justifies treating this as high operational priority. For devices where management access is strictly LAN-only and credentials are strong, the PR:L requirement provides a meaningful, though not absolute, barrier. The absence of a confirmed patched firmware version in the reference data means no remediation path is currently verified.

An attacker who possesses low-privilege credentials to the GL-MT3000 web management interface - obtained via credential stuffing, default credentials, or network interception - sends a crafted HTTP RPC request to the network.switch_info or network.switch_status endpoint with shell metacharacters injected into the switch parameter. The oui-httpd daemon passes the unsanitized argument directly to an OS command, resulting in arbitrary command execution on the router. A public PoC on GitHub documents the precise payload structure, making replication straightforward for any attacker who can reach the management interface.