GL.iNet GL-MT3000 CVE-2026-18684

The /cgi-bin/glc endpoint handling the remove_profile function must be reachable by the attacker over the network. Per the provided CVSS 4.0 vector (PR:N), no authentication is required; however, this claim comes from the VulDB reporter and has not been independently confirmed by a GL.iNet vendor advisory - an implicit authentication bypass may be part of the vulnerability chain and should be verified against the PoC. By default, GL.iNet routers expose the management interface on the LAN and Wi-Fi side only (192.168.8.1 on the LAN port); remote exploitation from the internet requires that WAN-side remote management has been explicitly enabled by the administrator - a non-default setting. Exploitation from a device already connected to the router's Wi-Fi (including guest networks if they share management access) requires only network reachability, not physical proximity. No specific modem hardware must be installed, no modem profiles need to exist, and no non-default firmware configuration is required - only that the CGI endpoint is reachable by the attacker.

The CVSS 4.0 score of 8.9 (High) is grounded in a maximally permissive base vector - AV:N/AC:L/AT:N/PR:N/UI:N with full VC:H/VI:H/VA:H - indicating unauthenticated, zero-complexity, remote exploitation with complete impact on the vulnerable system. The supplemental metric E:P (Proof of Concept) confirms functional exploit code is publicly available on GitHub, compressing the exploitation window and increasing realistic risk beyond base-score alone. EPSS data was not provided, so probabilistic exploitation forecasting is not available from that signal. The vulnerability is not currently in CISA's KEV catalog, so confirmed in-the-wild active exploitation has not been recorded by that authoritative source - though the public PoC and vendor acknowledgment make opportunistic scanning plausible. The primary real-world blast-radius limiter is network exposure: GL.iNet routers expose management CGI on the LAN/Wi-Fi interface by default (typically 192.168.8.1), not the WAN. This effectively shifts the practical attack vector to adjacent-network for default deployments, a meaningful risk reduction not reflected in the AV:N base score. Environments with remote management enabled or with untrusted clients on the same LAN segment face elevated exposure.

An attacker on the same LAN segment - or on the WAN if remote management is enabled - sends a crafted HTTP request to /cgi-bin/glc invoking remove_profile with a parameter containing shell metacharacters such as semicolons or backticks. The modem.so library passes the unsanitized value directly to a shell interpreter, executing the attacker-supplied command with the process's privileges, typically root on embedded Linux. A functional proof-of-concept is publicly available on GitHub requiring no significant exploit development expertise, making this scenario accessible to unskilled attackers.