GL-iNet GL-MT3000 CVE-2026-18616

The WireGuard server plugin (wg-server.so) must be active on the device, meaning the WireGuard server mode feature must be enabled in the GL-iNet firmware configuration - this is not guaranteed to be the default state and should be verified per deployment. The /cgi-bin/glc CGI endpoint must be reachable from the attacker's network position; the CVSS 4.0 vector (AV:N/PR:N/UI:N) indicates no authentication is required and no special attack prerequisites apply beyond network reachability. Exploitation is limited to GL-MT3000 devices running firmware 4.4.5 and earlier. The primary limiting factor for remote exploitation is whether the management interface is exposed to untrusted networks (WAN): if the CGI endpoint is restricted to LAN-only access, exploitation requires attacker presence on the local network segment. No user interaction is required, and attack complexity is low once reachability is established.

The CVSS 4.0 score of 8.9 reflects a network-accessible (AV:N), low-complexity (AC:L), unauthenticated (PR:N), no-user-interaction (UI:N) attack path with high confidentiality, integrity, and availability impact on the vulnerable system and no downstream scope change. The E:P exploit maturity modifier confirms publicly available exploit code, which the provided references corroborate via a GitHub POC repository. These signals collectively paint an elevated real-world risk picture: the attack requires no foothold or prior authentication, the exploit is published, and the impacted device class (consumer/SMB routers) is frequently exposed at network perimeters or insufficiently segmented. The absence of a CISA KEV listing means active widespread exploitation is not yet confirmed, but the gap between POC publication and mass exploitation on routers is historically narrow. EPSS data is not included in the provided intelligence; risk should therefore be treated as elevated pending KEV listing. No conflicting signals are present - the CVSS vector and description are consistent in indicating an unauthenticated network-reachable attack with full device impact.

An unauthenticated remote attacker sends a crafted HTTP POST request to the /cgi-bin/glc endpoint targeting the server.set_peer function, embedding shell metacharacters (e.g., a semicolon or command substitution sequence) in the public_key parameter value. The unsanitized input is passed to an underlying system call within wg-server.so, causing the injected command to execute with the privileges of the CGI process - typically root on embedded GL-iNet firmware. A public POC on GitHub demonstrates this technique against version 4.4.5, meaning the attack can be replicated by low-skill threat actors with minimal adaptation.