GL-MT3000 CVE-2026-18686

The GL-MT3000's NAS web sharing feature must be enabled and the /cgi-bin/glc CGI endpoint must be network-reachable from the attacker's position. Per the CVSS 4.0 PR:N metric, no authentication is required - the add_user function in the nas-web wrapper is exploitable without credentials. Exploitation is limited by: network reachability (attacker must reach the device's HTTP service, typically on LAN unless remote management or port forwarding is configured to expose the WAN interface); and the NAS feature being active. Devices with management interfaces exposed directly to the internet face the greatest risk. Devices reachable only from a trusted LAN are protected from remote internet-based exploitation but remain vulnerable to any compromised LAN host or insider threat.

The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) places this at the highest practical exploitability tier: no authentication, no special attack conditions, network-accessible, no user interaction required. The supplemental E:P metric confirms a public exploit exists. High impact across all three pillars (VC:H/VI:H/VA:H) reflects full OS-level command execution on the device. The vulnerability is NOT listed in CISA KEV, indicating no confirmed active mass exploitation at time of analysis - but the combination of unauthenticated network access, vendor confirmation, and public PoC makes dwell-time before exploitation likely short. No EPSS score is available in the provided data, so exploitation probability cannot be quantified from that signal. GL.iNet routers with remote management or NAS features exposed to the internet represent the highest-risk deployment scenario. The CVSS 4.0 score of 8.9 is well-calibrated to the actual risk signals.

An unauthenticated attacker with network access to the GL-MT3000's web interface sends a crafted HTTP request to /cgi-bin/glc invoking the nas-web add_user RPC function with shell metacharacters embedded in a user-controlled parameter field. The firmware's NAS wrapper passes the unsanitized input to a system command, executing the injected payload with the privileges of the web process - likely root on this embedded platform. A public proof-of-concept demonstrating this exact technique is available at https://github.com/coconut652-7/IOT_Vul_Public/tree/main/Glinet/MT3000/nas-web/ADD_USER_ADD_SHARE, providing a ready-made attack script.