GL.iNet GL-MT3000 CVE-2026-18602

The target must be a GL.iNet GL-MT3000 running firmware 4.4.0 through 4.4.5 with the /cgi-bin/glc endpoint and ovpn-client.so plugin active - this is a default configuration for these firmware versions. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) confirms no authentication is required and no user interaction is needed, meaning exploitation against a reachable device is fully attacker-controlled. The critical limiting factor is network reachability: if the router's admin interface is bound only to the LAN-side interface (a common default), an attacker must be on the local network or exploit a separate WAN-facing entry point first. However, GL-MT3000 travel routers are frequently used in configurations where the management interface is more broadly accessible, and some users explicitly enable remote management. No special non-default configuration, unusual privilege level, or prior foothold is required once the endpoint is reachable.

The CVSS 4.0 score of 8.9 (AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H) accurately reflects the severity: no authentication, no user interaction, low complexity, and full impact on the device's confidentiality, integrity, and availability. The absence of a scope change (SC:N/SI:N/SA:N) limits blast radius to the compromised router itself, though a compromised router sitting at a network boundary is inherently a pivot point. No EPSS score was provided in the input data, which limits quantitative exploitation probability assessment. The public PoC on GitHub is a strong independent risk amplifier - it operationalizes exploitation for lower-skilled threat actors. No CISA KEV listing exists at time of analysis, so active exploitation is not confirmed, only inferred from PoC availability. The vendor confirmed the vulnerability early in disclosure, adding credibility. Travel routers are frequently configured with management interfaces accessible beyond the LAN, which meaningfully expands the exposed attack surface relative to traditional home routers.

An unauthenticated remote attacker sends a crafted HTTP request to the /cgi-bin/glc endpoint of an internet-exposed GL-MT3000 router, embedding shell metacharacters (e.g., a semicolon followed by an arbitrary command) in the Hostname parameter of the ovpn-client.get_recommend_config function. The unsanitized input is passed to the underlying OpenWrt shell, executing the injected command with the privileges of the CGI process. A public PoC is available at https://github.com/StrTzz123/iot_vul/blob/main/GL-iNet/MT3000/4.4.5/ovpn_get_recommend_config_glc_rce/CVE.md, confirming exploitability and reducing the skill threshold to near-trivial.