21
CVEs
0
Critical
14
High
0
KEV
14
PoC
14
Unpatched C/H
4.8%
Patch Rate
1.5%
Avg EPSS
Severity Breakdown
CRITICAL
0
HIGH
14
MEDIUM
7
LOW
0
Monthly CVE Trend
Affected Products (30)
Gl Mt3000
21
Ar300m16 Firmware
17
Gl Ax1800 Firmware
16
Gl Ar300M Firmware
15
Gl Ar750S Firmware
14
Ax1800 Firmware
14
Gl Axt1800 Firmware
13
Gl Mt300N V2 Firmware
13
Gl Mt3000 Firmware
13
Xe300 Firmware
12
Gl B1300 Firmware
12
Mt300N V2 Firmware
12
Ar750 Firmware
12
Ar300M Firmware
12
X3000 Firmware
12
Sft1200 Firmware
12
Mt1300 Firmware
12
Gl A1300 Firmware
12
X750 Firmware
12
A1300 Firmware
12
Mt6000 Firmware
12
Axt1800 Firmware
12
Gl Mt2500 Firmware
12
Ar750S Firmware
12
Xe3000 Firmware
12
Mt2500 Firmware
12
Gl Mt1300 Firmware
12
Mt3000 Firmware
12
Gl Ar750 Firmware
12
B1300 Firmware
12
Top Risky CVEs
| CVE | Summary | Severity | CVSS | EPSS | Priority | Signals |
|---|---|---|---|---|---|---|
| CVE-2026-18686 | Command injection in GL.iNet GL-MT3000 router firmware (all versions through 4.4.5) allows unauthenticated remote attackers to execute arbitrary OS commands via the nas-web RPC wrapper's add_user function at /cgi-bin/glc. The vendor has confirmed the vulnerability exists following early disclosure, and a public proof-of-concept exploit is hosted on GitHub, materially lowering the barrier to exploitation. No patched firmware version is identified in the available data; the CVSS 4.0 score of 8.9 with E:P reflects unauthenticated network exploitability with a confirmed public exploit. | HIGH | 8.9 | 2.6% | 67 |
PoC
No patch
|
| CVE-2026-18601 | Remote command injection in GL.iNet GL-MT3000 router firmware (versions 4.4.0 through 4.4.5) allows unauthenticated network-reachable attackers to execute arbitrary OS commands by supplying a crafted filename argument to the ovpn-client.check_config function exposed via the /cgi-bin/glc CGI endpoint. The vendor confirmed the vulnerability's existence, and a public proof-of-concept exploit is published on GitHub (StrTzz123/iot_vul), materially lowering the bar for exploitation. The CVSS 4.0 score of 8.9 with exploit maturity E:P reflects a high-priority, real-world risk of complete device compromise with no authentication or user interaction required. | HIGH | 8.9 | 2.4% | 67 |
PoC
No patch
|
| CVE-2026-18612 | Remote command injection in GL-iNet GL-MT3000 firmware through version 4.4.5 allows unauthenticated network attackers to execute arbitrary OS commands via crafted package name input to the plugins.install_package or plugins.remove_package functions exposed through the /cgi-bin/glc CGI endpoint. The CVSS 4.0 vector confirms no authentication, no complexity barriers, and full confidentiality, integrity, and availability impact on the vulnerable system. A public proof-of-concept exploit is available on GitHub, no public exploit identified in CISA KEV at time of analysis, but the combination of unauthenticated network access and live exploit code makes this a high-urgency issue for any deployment with an internet-exposed management interface. | HIGH | 8.9 | 2.2% | 67 |
PoC
No patch
|
| CVE-2026-18684 | Command injection in GL.iNet GL-MT3000 firmware up to version 4.4.5 exposes the device to full remote compromise through its modem management CGI endpoint. The vulnerable remove_profile function within modem.so accepts unsanitized input via /cgi-bin/glc, enabling arbitrary OS command execution without authentication. A public proof-of-concept exploit is hosted on GitHub, materially lowering the barrier for opportunistic exploitation; no vendor-released patch has been confirmed at time of analysis. | HIGH | 8.9 | 2.0% | 67 |
PoC
No patch
|
| CVE-2026-18614 | Unauthenticated remote command injection in GL-iNet GL-MT3000 firmware (versions 4.4.0 through 4.4.5) allows network-adjacent or remote attackers to execute arbitrary OS commands by sending a crafted request to the /cgi-bin/glc CGI endpoint with a manipulated port argument passed to the s2s.enable_echo_server function. The vendor has confirmed the vulnerability, the CVSS 4.0 base score is 8.9 with full high-impact ratings across confidentiality, integrity, and availability, and a public proof-of-concept exploit is available on GitHub, materially lowering the exploitation bar. No public CISA KEV listing exists at time of analysis, but the combination of unauthenticated network access and a published PoC makes active exploitation a near-term realistic risk. | HIGH | 8.9 | 2.0% | 67 |
PoC
No patch
|
| CVE-2026-18602 | Remote command injection in GL.iNet GL-MT3000 routers (firmware 4.4.0-4.4.5) allows unauthenticated network attackers to execute arbitrary OS commands by supplying crafted shell metacharacters in the Hostname argument to the ovpn-client.get_recommend_config function exposed via the /cgi-bin/glc CGI endpoint. The vendor has confirmed the vulnerability's existence, and a public proof-of-concept exploit is hosted on GitHub, materially lowering the exploitation barrier. No public exploit identified as confirmed actively exploited (CISA KEV) at time of analysis, but the PR:N/UI:N posture combined with a live PoC makes opportunistic exploitation against internet-exposed travel routers a credible near-term risk. | HIGH | 8.9 | 2.0% | 66 |
PoC
No patch
|
| CVE-2026-18615 | Remote command injection in the GL-iNet GL-MT3000 travel router (firmware 4.4.0-4.4.5) allows unauthenticated network-adjacent or internet-exposed attackers to execute arbitrary OS commands by supplying a maliciously crafted `private_key` argument to the WireGuard server public key generation endpoint at `/cgi-bin/glc`. The vendor has confirmed the vulnerability, and a public proof-of-concept exploit is available on GitHub, significantly lowering the barrier to exploitation. No active exploitation has been confirmed by CISA KEV, but the combination of PR:N attack profile and public POC warrants urgent remediation on any internet-exposed device. | HIGH | 8.9 | 2.0% | 66 |
PoC
No patch
|
| CVE-2026-18616 | Remote command injection in GL-iNet GL-MT3000 firmware (up to version 4.4.5) allows unauthenticated network attackers to execute arbitrary OS commands on the device by supplying a malicious public_key argument to the server.set_peer function exposed via the /cgi-bin/glc CGI endpoint of the WireGuard server native plugin (wg-server.so). The vendor has confirmed the vulnerability following coordinated disclosure, and a public proof-of-concept exploit is available on GitHub, materially lowering the barrier to exploitation. No publicly confirmed KEV-listed active exploitation is identified at time of analysis, though the combination of unauthenticated network access, high-impact command execution, and available POC makes this an urgent remediation priority for any deployment. | HIGH | 8.9 | 2.0% | 66 |
PoC
No patch
|
| CVE-2026-18685 | Command injection in GL.iNet GL-MT3000 firmware up to version 4.4.5 allows remote attackers to execute arbitrary OS commands through the `set_upgrade` function exposed via the `/cgi-bin/glc` CGI endpoint in `modem.so`. The CVSS 4.0 base score of 8.9 (with E:P reflecting public exploit availability) reflects high confidentiality, integrity, and availability impact on the affected device. A public proof-of-concept exploit has been disclosed on GitHub and the vendor has confirmed the vulnerability's existence, making this an active remediation priority for any network exposing the GL-MT3000 management interface. | HIGH | 8.9 | 2.0% | 66 |
PoC
No patch
|
| CVE-2026-18613 | Injection vulnerability in GL-iNet GL-MT3000 (Beryl AX) firmware through version 4.4.5 exposes the plugins.set_config function via /cgi-bin/glc to remote exploitation with no authentication or user interaction required per the CVSS 4.0 vector. Successful exploitation yields high confidentiality, integrity, and availability impact on the device, consistent with OS command or argument injection against the native plugin handler. A proof-of-concept exploit is publicly available on GitHub and the vendor has confirmed the vulnerability, though no patch has been released at time of analysis. | HIGH | 8.9 | 0.5% | 65 |
PoC
No patch
|
| CVE-2026-18600 | Command injection in the GL.iNet GL-MT3000 router's Network Lua RPC Plugin allows authenticated remote attackers to execute arbitrary OS commands by injecting shell metacharacters into the `switch` argument of the `network.switch_info` or `network.switch_status` RPC methods. Firmware versions 4.4.0 through 4.4.5 are confirmed affected, with the vendor acknowledging the vulnerability following coordinated disclosure. A public proof-of-concept exploit has been published on GitHub (E:P reflected in the CVSS 4.0 vector), no public exploit identified as confirmed actively exploited (CISA KEV), though the low complexity and available PoC materially lower the bar for exploitation. | HIGH | 7.4 | 2.0% | 59 |
PoC
No patch
|
| CVE-2026-18598 | Remote command injection in GL.iNet GL-MT3000 router firmware (versions 4.4.0-4.4.5) allows an authenticated network attacker to execute arbitrary OS commands by manipulating the `module` argument of the `logread.get_system_log` RPC function in the Logread Lua plugin. The vendor confirmed the vulnerability following coordinated disclosure, and a public proof-of-concept exploit is available on GitHub. No publicly available exploit confirms CISA KEV-level active exploitation at time of analysis, though the combination of a PoC and a widely used consumer router creates meaningful opportunistic risk. | HIGH | 7.4 | 1.7% | 59 |
PoC
No patch
|
| CVE-2026-18787 | Command injection in GL.iNet AX1800 router firmware up to version 4.8.3 allows a low-privileged authenticated remote attacker to execute arbitrary OS commands via the `remove_rule` RPC endpoint. The vulnerable parameter `args.id` in `/usr/share/gl-ngx/oui-rpc.lua` is passed unsanitized to a shell command, enabling full device takeover. No public KEV listing exists, but a proof-of-concept exploit is publicly available on GitHub, meaningfully lowering the barrier to exploitation. | HIGH | 7.4 | 1.7% | 59 |
PoC
No patch
|
| CVE-2026-18599 | Command injection in GL.iNet GL-MT3000 firmware versions 4.4.0 through 4.4.5 allows an adjacent, low-privileged attacker to execute arbitrary OS commands by manipulating the `record_size` argument in the `logread.set_config` RPC function of the Logread Lua plugin. A proof-of-concept exploit has been publicly released on GitHub, and the vendor confirmed the vulnerability exists following early disclosure. While not yet listed in CISA KEV, the combination of low attack complexity, public exploit code, and full high-impact confidentiality/integrity/availability compromise makes this a credible and actionable risk for any network where GL-MT3000 devices are deployed. | HIGH | 7.3 | 1.4% | 58 |
PoC
No patch
|
| CVE-2026-19983 | OS command injection in GL.iNet firmware 4.8.x exposes eight router models to unauthenticated remote root code execution via the NAS Command Service binary at /usr/bin/gl_nas_sys. GL.iNet's own CVE advisory on GitHub characterizes the attack as a 'Host-header bypass to unauthenticated root RCE,' meaning the Host HTTP header can be manipulated to circumvent the service's authentication layer before injecting arbitrary OS commands. The vendor has confirmed the vulnerability, vendor-released patch version 4.9.0 is available, and no public exploit identified at time of analysis, though the GL.iNet-hosted writeup substantially documents the attack mechanism. | MEDIUM | 6.9 | 1.3% | 36 |
No patch
|