GL-iNet GL-MT3000 EUVD-2026-52401

The /cgi-bin/glc endpoint hosting the wg-server.generate_publickey function must be reachable from the attacker's network position. The CVSS 4.0 base vector specifies PR:N and UI:N, indicating no authentication and no user interaction are required; however, it is not independently confirmed from available data whether the GL-MT3000 admin session layer is entirely absent on this endpoint or bypassed by the exploit technique - the PR:N classification should be validated against the published POC. No special firmware configuration beyond the default WireGuard server plugin being present is indicated as a prerequisite. Exploitation is limited in practice by network reachability: GL-iNet travel routers typically expose the management interface on the LAN by default, not the WAN, but administrators who expose the router's management port or WireGuard port to the internet eliminate this barrier. A device used as a VPN server endpoint may have relevant ports forwarded, increasing exposure.

The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) represents the most severe possible attack profile: unauthenticated, remotely exploitable, no special attack requirements, and no user interaction needed. High impact across confidentiality, integrity, and availability on the vulnerable system aligns with full OS command execution on an embedded Linux router, typically running as root. The E:P supplemental metric confirms publicly available exploit code, directly compressing the time-to-exploitation window. No CISA KEV listing is present, so mass active exploitation is not confirmed, but this should not be treated as reassurance given the POC exists and GL-iNet travel routers may have management interfaces or WireGuard ports exposed to the internet. EPSS data was not provided in the source intelligence, leaving statistical exploitation probability unquantified. A key uncertainty is whether the endpoint truly requires no authentication (PR:N) in default firmware configuration - if GL-iNet's admin session layer applies, real-world exploitation may require credential theft or a session bypass step not described in available data. This should be verified against the POC and vendor advisory when available.

An attacker with network access to the GL-MT3000's management interface sends a crafted HTTP POST request to /cgi-bin/glc targeting the WireGuard server key generation function, embedding shell metacharacters such as a semicolon or backtick within the private_key parameter value. The wg-server.generate_publickey function passes the unsanitized argument to an OS shell command, causing the injected payload - for example a reverse shell or credential extraction command - to execute with the privileges of the web server process, which on embedded GL-iNet devices is typically root. The publicly available proof-of-concept at the referenced GitHub repository demonstrates a working exploitation path against firmware 4.4.5.