Critical Command Injection Hits GL.iNet MT3000

A critical security vulnerability has been identified in the GL.iNet GL-MT3000 router, specifically within the nas-web RPC wrapper. Tracked as CVE-2026-18686, this flaw allows remote, unauthenticated attackers to perform command injection, leading to full system compromise. With a CVSS score of 9.8, the vulnerability is classified as critical and is currently public, increasing the risk of exploitation.

What's at Risk

The vulnerability affects GL.iNet GL-MT3000 devices running firmware versions up to 4.4.5. The issue resides in the nas-web.add_user function within the /cgi-bin/glc file. Devices that are exposed to the public internet are at the highest risk, as the attack can be initiated remotely without requiring prior authentication or user interaction.

Users maintaining these routers in home or small office environments should consider their exposure levels. Because the flaw exists in a core management component, any device accessible via the web interface is a potential target for unauthorized command execution.

How the Flaw Works

Command injection occurs when an application fails to properly sanitize user-supplied input before passing it to a system shell. In a general sense, this type of vulnerability allows an attacker to append their own malicious commands to the intended system operation. By manipulating parameters that the application expects to process, the attacker can force the underlying operating system to execute arbitrary instructions with the privileges of the web service.

Once an attacker successfully injects commands, they can often bypass authentication, modify system configurations, or install persistent backdoors. Because these commands are executed at the system level, the attacker essentially gains control over the router's functionality, potentially leading to data interception or the integration of the device into a larger malicious network.

How to Protect Your Systems

• Verify your current firmware version and update to the latest release provided by GL.iNet immediately.
• Disable remote web management access on the router if it is not strictly required for your operations.
• Ensure the device is not directly exposed to the public internet; utilize a VPN or a secure gateway if remote access is necessary.
• Monitor system logs for unusual user account creation or unexpected network traffic patterns.
• Implement strong, unique administrative passwords to mitigate the impact of potential unauthorized access attempts.

Given the critical severity of CVE-2026-18686 and the public availability of exploit information, prompt action is essential. Attackers frequently target routers due to their position at the edge of the network, making them high-value entry points. Applying available security updates and restricting network exposure are the most effective ways to defend against this specific threat and maintain the integrity of your local network environment.