32
CVEs
0
Critical
17
High
0
KEV
18
PoC
14
Unpatched C/H
21.9%
Patch Rate
1.3%
Avg EPSS
Severity Breakdown
CRITICAL
0
HIGH
17
MEDIUM
12
LOW
3
Monthly CVE Trend
Affected Products (30)
Gl Mt3000
21
Ar300m16 Firmware
17
Gl Ax1800 Firmware
16
Gl Ar300M Firmware
15
Gl Ar750S Firmware
14
Ax1800 Firmware
14
Gl Axt1800 Firmware
13
Gl Mt300N V2 Firmware
13
Gl Mt3000 Firmware
13
Xe300 Firmware
12
Gl B1300 Firmware
12
Mt300N V2 Firmware
12
Ar750 Firmware
12
Ar300M Firmware
12
X3000 Firmware
12
Sft1200 Firmware
12
Mt1300 Firmware
12
Gl A1300 Firmware
12
X750 Firmware
12
A1300 Firmware
12
Mt6000 Firmware
12
Axt1800 Firmware
12
Gl Mt2500 Firmware
12
Ar750S Firmware
12
Xe3000 Firmware
12
Mt2500 Firmware
12
Gl Mt1300 Firmware
12
Mt3000 Firmware
12
Gl Ar750 Firmware
12
B1300 Firmware
12
Top Risky CVEs
| CVE | Summary | Severity | CVSS | EPSS | Priority | Signals |
|---|---|---|---|---|---|---|
| CVE-2026-18686 | Command injection in GL.iNet GL-MT3000 router firmware (all versions through 4.4.5) allows unauthenticated remote attackers to execute arbitrary OS commands via the nas-web RPC wrapper's add_user function at /cgi-bin/glc. The vendor has confirmed the vulnerability exists following early disclosure, and a public proof-of-concept exploit is hosted on GitHub, materially lowering the barrier to exploitation. No patched firmware version is identified in the available data; the CVSS 4.0 score of 8.9 with E:P reflects unauthenticated network exploitability with a confirmed public exploit. | HIGH | 8.9 | 2.6% | 67 |
PoC
No patch
|
| CVE-2026-18601 | Remote command injection in GL.iNet GL-MT3000 router firmware (versions 4.4.0 through 4.4.5) allows unauthenticated network-reachable attackers to execute arbitrary OS commands by supplying a crafted filename argument to the ovpn-client.check_config function exposed via the /cgi-bin/glc CGI endpoint. The vendor confirmed the vulnerability's existence, and a public proof-of-concept exploit is published on GitHub (StrTzz123/iot_vul), materially lowering the bar for exploitation. The CVSS 4.0 score of 8.9 with exploit maturity E:P reflects a high-priority, real-world risk of complete device compromise with no authentication or user interaction required. | HIGH | 8.9 | 2.4% | 67 |
PoC
No patch
|
| CVE-2026-18612 | Remote command injection in GL-iNet GL-MT3000 firmware through version 4.4.5 allows unauthenticated network attackers to execute arbitrary OS commands via crafted package name input to the plugins.install_package or plugins.remove_package functions exposed through the /cgi-bin/glc CGI endpoint. The CVSS 4.0 vector confirms no authentication, no complexity barriers, and full confidentiality, integrity, and availability impact on the vulnerable system. A public proof-of-concept exploit is available on GitHub, no public exploit identified in CISA KEV at time of analysis, but the combination of unauthenticated network access and live exploit code makes this a high-urgency issue for any deployment with an internet-exposed management interface. | HIGH | 8.9 | 2.2% | 67 |
PoC
No patch
|
| CVE-2026-18684 | Command injection in GL.iNet GL-MT3000 firmware up to version 4.4.5 exposes the device to full remote compromise through its modem management CGI endpoint. The vulnerable remove_profile function within modem.so accepts unsanitized input via /cgi-bin/glc, enabling arbitrary OS command execution without authentication. A public proof-of-concept exploit is hosted on GitHub, materially lowering the barrier for opportunistic exploitation; no vendor-released patch has been confirmed at time of analysis. | HIGH | 8.9 | 2.0% | 67 |
PoC
No patch
|
| CVE-2026-18614 | Unauthenticated remote command injection in GL-iNet GL-MT3000 firmware (versions 4.4.0 through 4.4.5) allows network-adjacent or remote attackers to execute arbitrary OS commands by sending a crafted request to the /cgi-bin/glc CGI endpoint with a manipulated port argument passed to the s2s.enable_echo_server function. The vendor has confirmed the vulnerability, the CVSS 4.0 base score is 8.9 with full high-impact ratings across confidentiality, integrity, and availability, and a public proof-of-concept exploit is available on GitHub, materially lowering the exploitation bar. No public CISA KEV listing exists at time of analysis, but the combination of unauthenticated network access and a published PoC makes active exploitation a near-term realistic risk. | HIGH | 8.9 | 2.0% | 67 |
PoC
No patch
|
| CVE-2026-18602 | Remote command injection in GL.iNet GL-MT3000 routers (firmware 4.4.0-4.4.5) allows unauthenticated network attackers to execute arbitrary OS commands by supplying crafted shell metacharacters in the Hostname argument to the ovpn-client.get_recommend_config function exposed via the /cgi-bin/glc CGI endpoint. The vendor has confirmed the vulnerability's existence, and a public proof-of-concept exploit is hosted on GitHub, materially lowering the exploitation barrier. No public exploit identified as confirmed actively exploited (CISA KEV) at time of analysis, but the PR:N/UI:N posture combined with a live PoC makes opportunistic exploitation against internet-exposed travel routers a credible near-term risk. | HIGH | 8.9 | 2.0% | 66 |
PoC
No patch
|
| CVE-2026-18615 | Remote command injection in the GL-iNet GL-MT3000 travel router (firmware 4.4.0-4.4.5) allows unauthenticated network-adjacent or internet-exposed attackers to execute arbitrary OS commands by supplying a maliciously crafted `private_key` argument to the WireGuard server public key generation endpoint at `/cgi-bin/glc`. The vendor has confirmed the vulnerability, and a public proof-of-concept exploit is available on GitHub, significantly lowering the barrier to exploitation. No active exploitation has been confirmed by CISA KEV, but the combination of PR:N attack profile and public POC warrants urgent remediation on any internet-exposed device. | HIGH | 8.9 | 2.0% | 66 |
PoC
No patch
|
| CVE-2026-18616 | Remote command injection in GL-iNet GL-MT3000 firmware (up to version 4.4.5) allows unauthenticated network attackers to execute arbitrary OS commands on the device by supplying a malicious public_key argument to the server.set_peer function exposed via the /cgi-bin/glc CGI endpoint of the WireGuard server native plugin (wg-server.so). The vendor has confirmed the vulnerability following coordinated disclosure, and a public proof-of-concept exploit is available on GitHub, materially lowering the barrier to exploitation. No publicly confirmed KEV-listed active exploitation is identified at time of analysis, though the combination of unauthenticated network access, high-impact command execution, and available POC makes this an urgent remediation priority for any deployment. | HIGH | 8.9 | 2.0% | 66 |
PoC
No patch
|
| CVE-2026-18685 | Command injection in GL.iNet GL-MT3000 firmware up to version 4.4.5 allows remote attackers to execute arbitrary OS commands through the `set_upgrade` function exposed via the `/cgi-bin/glc` CGI endpoint in `modem.so`. The CVSS 4.0 base score of 8.9 (with E:P reflecting public exploit availability) reflects high confidentiality, integrity, and availability impact on the affected device. A public proof-of-concept exploit has been disclosed on GitHub and the vendor has confirmed the vulnerability's existence, making this an active remediation priority for any network exposing the GL-MT3000 management interface. | HIGH | 8.9 | 2.0% | 66 |
PoC
No patch
|
| CVE-2026-18613 | Injection vulnerability in GL-iNet GL-MT3000 (Beryl AX) firmware through version 4.4.5 exposes the plugins.set_config function via /cgi-bin/glc to remote exploitation with no authentication or user interaction required per the CVSS 4.0 vector. Successful exploitation yields high confidentiality, integrity, and availability impact on the device, consistent with OS command or argument injection against the native plugin handler. A proof-of-concept exploit is publicly available on GitHub and the vendor has confirmed the vulnerability, though no patch has been released at time of analysis. | HIGH | 8.9 | 0.5% | 65 |
PoC
No patch
|
| CVE-2026-12186 | Authenticated command injection in the GL.iNet GL-MT3000 travel router (firmware up to 4.4.5) lets remote attackers with low-privileged access execute arbitrary OS commands via the replace_country function in the Tor Proxy Service configuration handler. Publicly available exploit code exists for the flaw, and the vendor has shipped a fix; no public exploit identified at time of analysis as actively exploited in the wild. | HIGH | 7.4 | 2.0% | 59 |
PoC
|
| CVE-2026-12187 | Command injection in the GL.iNet GL-MT3000 travel router's Online Firmware Upgrade Handler (/usr/bin/one_click_upgrade) allows authenticated remote attackers to execute arbitrary OS commands on devices running firmware up to 4.4.5. Publicly available exploit code exists on GitHub, and the issue is fixed in firmware 4.7 (with 4.8.1 currently published by the vendor). No CISA KEV listing has been confirmed, but the combination of a published PoC and an internet-exposable management interface raises the practical risk above the headline CVSS score. | HIGH | 7.4 | 2.0% | 59 |
PoC
|
| CVE-2026-18600 | Command injection in the GL.iNet GL-MT3000 router's Network Lua RPC Plugin allows authenticated remote attackers to execute arbitrary OS commands by injecting shell metacharacters into the `switch` argument of the `network.switch_info` or `network.switch_status` RPC methods. Firmware versions 4.4.0 through 4.4.5 are confirmed affected, with the vendor acknowledging the vulnerability following coordinated disclosure. A public proof-of-concept exploit has been published on GitHub (E:P reflected in the CVSS 4.0 vector), no public exploit identified as confirmed actively exploited (CISA KEV), though the low complexity and available PoC materially lower the bar for exploitation. | HIGH | 7.4 | 2.0% | 59 |
PoC
No patch
|
| CVE-2026-18598 | Remote command injection in GL.iNet GL-MT3000 router firmware (versions 4.4.0-4.4.5) allows an authenticated network attacker to execute arbitrary OS commands by manipulating the `module` argument of the `logread.get_system_log` RPC function in the Logread Lua plugin. The vendor confirmed the vulnerability following coordinated disclosure, and a public proof-of-concept exploit is available on GitHub. No publicly available exploit confirms CISA KEV-level active exploitation at time of analysis, though the combination of a PoC and a widely used consumer router creates meaningful opportunistic risk. | HIGH | 7.4 | 1.7% | 59 |
PoC
No patch
|
| CVE-2026-18787 | Command injection in GL.iNet AX1800 router firmware up to version 4.8.3 allows a low-privileged authenticated remote attacker to execute arbitrary OS commands via the `remove_rule` RPC endpoint. The vulnerable parameter `args.id` in `/usr/share/gl-ngx/oui-rpc.lua` is passed unsanitized to a shell command, enabling full device takeover. No public KEV listing exists, but a proof-of-concept exploit is publicly available on GitHub, meaningfully lowering the barrier to exploitation. | HIGH | 7.4 | 1.7% | 59 |
PoC
No patch
|