What is the CVSS score of CVE-2026-26794?

CVE-2026-26794 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

Which versions of Ar300m16 Firmware are affected by CVE-2026-26794?

A SQL injection vulnerability in GL-iNet GL-AR300M16 routers (v4.3.11) could allow attackers to compromise device databases and potentially access sensitive network data.

How to fix or mitigate CVE-2026-26794?

Within 24 hours: Inventory all GL-AR300M16 v4.3.11 devices and isolate affected units from critical network segments; disable remote access to the device management interface. Within 7 days: Apply network segmentation to restrict administrative access; implement compensating controls listed below. Within 30 days: Monitor GL-iNet for patch availability and plan immediate deployment upon release; evaluate replacement devices if patch delays extend beyond 60 days.

Ar300m16 Firmware CVE-2026-26794

HIGH

SQL Injection (CWE-89)

2026-03-12 cve@mitre.org

SQLi Ar300m16 Firmware

8.8

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

8.8 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Mar 12, 2026 - 19:57 vuln.today

CVE Published

Mar 12, 2026 - 18:16 nvd

HIGH 8.8

DescriptionCVE.org

GL-iNet GL-AR300M16 v4.3.11 was discovered to contain a SQL injection vulnerability via the add_group() function. This vulnerability allows attackers to execute arbitrary SQL database operations via a crafted HTTP request.

AnalysisAI

SQL injection in GL-iNet GL-AR300M16 firmware v4.3.11 allows authenticated attackers to execute arbitrary database commands through the add_group() function via crafted HTTP requests. The vulnerability affects all installations of the affected firmware version and requires valid credentials to exploit. No patch is currently available to remediate this high-severity flaw.

Technical ContextAI

The GL-AR300M16 is a compact travel router running OpenWrt-based firmware, commonly used in small office and travel scenarios for creating secure network connections. The vulnerability manifests as a classic SQL injection (CWE-89) where user-supplied input in the add_group() function is not properly sanitized before being incorporated into SQL queries, allowing attackers to inject malicious SQL statements. This type of vulnerability typically occurs when dynamic SQL queries are constructed using string concatenation without proper input validation or parameterized queries, enabling attackers to manipulate the underlying database structure and data.

RemediationAI

The primary remediation is to update the GL-AR300M16 firmware to a version newer than 4.3.11 once GL-iNet releases a security patch addressing this SQL injection vulnerability. Until an official patch is available, organizations should implement compensating controls including restricting administrative access to trusted IP addresses only, enabling strong authentication mechanisms, monitoring for suspicious database queries or unauthorized group creation attempts, and considering placing affected devices behind additional security controls such as web application firewalls that can filter SQL injection attempts.