Description
A vulnerability has been found in GL.iNet GL-MT3000 up to 4.4.5. This affects the function network.switch_info/network.switch_status of the file /usr/lib/oui-httpd/rpc/network of the component Network Lua RPC Plugin. Such manipulation of the argument switch leads to command injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure and confirmed the existence of the vulnerability.
Published: 2026-08-03
Score: 8.7 High
EPSS: 2.0% Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

The vulnerability is a command injection flaw in the network.switch_info and network.switch_status RPC functions of GL.iNet's GL‑MT3000 firmware. An attacker can supply a crafted switch argument that is passed unchecked to the underlying shell, enabling the execution of arbitrary commands on the device. This results in full control of the router, including the ability to exfiltrate data, disrupt network services, or use the device in a botnet.

Affected Systems

The flaw affects GL.iNet GL‑MT3000 routers running firmware versions up to 4.4.5. The vulnerable component is the Network Lua RPC Plugin, specifically the network.switch_info and network.switch_status functions exposed through /usr/lib/oui-httpd/rpc/network.

Risk and Exploitability

The CVSS v3 score of 8.7 indicates high severity and the attack vector is remote. The CVE description does not specify whether authentication is required, so the possibility of exploitation may depend on target configuration. The EPSS score of 2% indicates a low probability of exploitation, and the vulnerability is not listed in the CISA KEV catalog. Given the lack of explicit authentication details and the potential for arbitrary code execution, the risk is high and a publicly disclosed exploit exists.

Generated by OpenCVE AI on August 4, 2026 at 21:08 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Update the router to a firmware revision newer than 4.4.5 that addresses the command injection in the network Lua RPC Plugin; if no patch is available, postpone deployment until one is released.
  • Restrict remote access to the RPC interface by configuring firewall rules or disabling the network Lua RPC service on the device.
  • Implement input validation or sanitization for RPC parameters, ensuring that any shell metacharacters are escaped before command execution, to prevent injection if the vulnerability persists.

Generated by OpenCVE AI on August 4, 2026 at 21:08 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Mon, 03 Aug 2026 15:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Mon, 03 Aug 2026 14:45:00 +0000

Type Values Removed Values Added
First Time appeared Gl-inet gl-mt3000
Vendors & Products Gl-inet gl-mt3000

Mon, 03 Aug 2026 13:45:00 +0000

Type Values Removed Values Added
Description A vulnerability has been found in GL.iNet GL-MT3000 up to 4.4.5. This affects the function network.switch_info/network.switch_status of the file /usr/lib/oui-httpd/rpc/network of the component Network Lua RPC Plugin. Such manipulation of the argument switch leads to command injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure and confirmed the existence of the vulnerability.
Title GL.iNet GL-MT3000 Network Lua RPC Plugin network network.switch_status command injection
First Time appeared Gl-inet
Gl-inet gl-mt3000 Firmware
Weaknesses CWE-74
CWE-77
CPEs cpe:2.3:o:gl-inet:gl-mt3000_firmware:*:*:*:*:*:*:*:*
Vendors & Products Gl-inet
Gl-inet gl-mt3000 Firmware
References
Metrics cvssV2_0

{'score': 9, 'vector': 'AV:N/AC:L/Au:S/C:C/I:C/A:C/E:POC/RL:ND/RC:C'}

cvssV3_0

{'score': 8.8, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:X/RC:R'}

cvssV3_1

{'score': 8.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:X/RC:R'}

cvssV4_0

{'score': 8.7, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P'}

Subscriptions

Gl-inet Gl-mt3000 Gl-mt3000 Firmware
cve-icon MITRE

Status: PUBLISHED

Assigner: VulDB

Published:

Updated: 2026-08-03T14:50:38.393Z

Reserved: 2026-08-03T06:55:19.221Z

Link: CVE-2026-18600

cve-icon Vulnrichment

Updated: 2026-08-03T14:50:30.713Z

cve-icon NVD

Status : Deferred

Published: 2026-08-03T14:16:25.763

Modified: 2026-08-12T21:00:37.147

Link: CVE-2026-18600

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-08-04T21:15:03Z

Weaknesses
  • CWE-74

    Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')

  • CWE-77

    Improper Neutralization of Special Elements used in a Command ('Command Injection')