GL.iNet GL-MT3000 CVE-2026-18601

The /cgi-bin/glc CGI endpoint must be reachable by the attacker, which is satisfied by default for any device on the same LAN as the router - no special network configuration is required for LAN-side exploitation. WAN-side exploitation is possible only if GL.iNet remote web administration is explicitly enabled (non-default). The ovpn-client.so plugin must be present in firmware, which is confirmed for all 4.4.0-4.4.5 builds per EUVD-2026-52271. Per the CVSS 4.0 PR:N rating sourced from VulDB, no authentication is required to invoke the vulnerable function; however, this has not been independently verified against GL.iNet's CGI authentication gating in firmware - if a session check exists upstream of check_config, the actual privilege requirement may be higher. Exploitation is hardware-specific to GL-MT3000; other GL.iNet models are not confirmed affected.

The CVSS 4.0 base vector (AV:N/AC:L/AT:N/PR:N/UI:N) represents the most severe exploitation profile possible: the vulnerable endpoint is reachable over the network, requires no complexity or preconditions, no privileges, and no user interaction. Full impact across VC:H/VI:H/VA:H indicates complete router takeover. The exploit maturity modifier E:P confirms publicly available exploit code on GitHub, directly reducing attacker skill requirements. This CVE is not listed in CISA KEV at time of analysis, so confirmed active mass exploitation is not established; however, the combination of PR:N, a public PoC, and vendor confirmation warrants immediate prioritization for any internet-exposed or publicly-routed GL-MT3000. No EPSS score was provided in the input data, which is a gap in the intelligence picture. The primary real-world risk reduction factor is network exposure: devices where the admin CGI interface is isolated to a trusted LAN and WAN admin access is disabled face a reduced but non-zero threat from LAN-side attackers or compromised clients.

An attacker on the same LAN as the GL-MT3000 - or on the WAN if remote admin is enabled - sends a crafted HTTP request to /cgi-bin/glc with a filename parameter containing shell metacharacters such as semicolons or command substitution syntax. The ovpn-client.so native plugin passes this value directly to a system-level call without sanitization, executing the injected command with the router firmware process's privileges. The public PoC CVE.md on GitHub provides the exact request format, enabling exploitation by low-skill attackers with minimal adaptation.