Ar300m16 Firmware CVE-2026-26794

GL-iNet GL-AR300M16 v4.3.11 with add_group() function accessible. Requires valid user credentials (PR:L) for authentication to the web interface.

The CVSS 3.1 score of 8.8 indicates high severity with network-based attack vector (AV:N), low complexity (AC:L), and low privilege requirement (PR:L), meaning any authenticated user can exploit this remotely without special conditions. However, the vulnerability is not currently listed in CISA's Known Exploited Vulnerabilities catalog and lacks public EPSS data, suggesting no confirmed in-the-wild exploitation yet. The requirement for authentication slightly reduces the immediate risk compared to unauthenticated vulnerabilities, but the potential for complete database compromise and the network-accessible nature make this a priority for patching in production environments where these routers are deployed.

An attacker with low-privileged credentials to the GL-AR300M16 web interface could craft malicious HTTP requests to the add_group() function containing SQL injection payloads, potentially extracting sensitive configuration data, modifying user permissions, or disrupting router operations. The network-accessible nature and low complexity mean this could be automated for mass exploitation once a proof-of-concept becomes available. Given the typical deployment of these routers in less-secured environments like travel or small offices, successful exploitation could provide attackers with a foothold into otherwise protected networks.