CVE-2026-18601

GL.iNet GL-MT3000 ovpn-client.so Native Plugin glc ovpn-client.check_config command injection

View on CVE.org
Published Aug 3, 2026 CVSS 4.0 · 9.3 Critical EPSS 3.6% KEV · Not listed
Description
A vulnerability was found in GL.iNet GL-MT3000 up to 4.4.5. This impacts the function ovpn-client.check_config of the file /cgi-bin/glc of the component ovpn-client.so Native Plugin. Performing a manipulation of the argument filename results in command injection. Remote exploitation of the attack is possible. The exploit has been made public and could be used. The vendor was contacted early about this disclosure and confirmed the existence of the vulnerability.

Analysis

AI-generated

Technical impact

The vulnerability is a command injection in the ovpn-client.check_config function of the /cgi-bin/glc script in the native plugin ovpn-client.so on GL.iNet GL‑MT3000 routers. A malformed filename parameter allows a remote attacker to execute arbitrary shell commands on the device, potentially leading to full system compromise. The flaw exists because the input is passed directly to the operating system without proper sanitization, matching CWE‑74 (Command Injection) and CWE‑77 (Improper Command Execution).

Affected Systems

Affected devices are GL.iNet GL‑MT3000 routers running firmware versions up to and including 4.4.5. The issue is tracked in the CVE record for CVE‑2026‑18601 and has been disclosed publicly.

Risk and Exploitability

The CVSS score of 9.3 indicates critical severity, and the EPSS score of 4% implies a low but non‑zero likelihood of exploitation. The vulnerability is remotely exploitable and a publicly available exploit exists. The likely attack vector is a remote HTTP request to the /cgi-bin/glc endpoint, which, if the device is reachable from the internet or an untrusted network, can be used to inject commands. The vendor has not listed the issue in the CISA KEV catalog.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Apply the latest GL.iNet firmware update that fixes the ovpn-client.check_config command injection vulnerability (e.g., upgrade to any version above 4.4.5).
  • If no patch is available, block remote access to the /cgi-bin/glc endpoint by configuring the router’s firewall or upstream network ACLs to allow only local or trusted network hosts.
  • Consider disabling the ovpn-client service or the glc plugin entirely if the device does not require VPN client functionality, thereby removing the vulnerability surface.

Generated by OpenCVE AI on September 24, 2026 at 18:57 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories available
History
Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'poc', 'Technical Impact': 'total'}, 'version': '2.0.3'}
Type Values Removed Values Added
First Time appeared Gl-inet gl-mt3000
Vendors & Products Gl-inet gl-mt3000
Type Values Removed Values Added
Description A vulnerability was found in GL.iNet GL-MT3000 up to 4.4.5. This impacts the function ovpn-client.check_config of the file /cgi-bin/glc of the component ovpn-client.so Native Plugin. Performing a manipulation of the argument filename results in command injection. Remote exploitation of the attack is possible. The exploit has been made public and could be used. The vendor was contacted early about this disclosure and confirmed the existence of the vulnerability.
Title GL.iNet GL-MT3000 ovpn-client.so Native Plugin glc ovpn-client.check_config command injection
First Time appeared Gl-inet
Gl-inet gl-mt3000 Firmware
Weaknesses CWE-74
CWE-77
CPEs cpe:2.3:o:gl-inet:gl-mt3000_firmware:*:*:*:*:*:*:*:*
Vendors & Products Gl-inet
Gl-inet gl-mt3000 Firmware
References
Metrics cvssV2_0

{'score': 10, 'vector': 'AV:N/AC:L/Au:N/C:C/I:C/A:C/E:POC/RL:ND/RC:C'}

cvssV3_0

{'score': 9.8, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P/RL:X/RC:R'}

cvssV3_1

{'score': 9.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P/RL:X/RC:R'}

cvssV4_0

{'score': 9.3, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P'}
Weaknesses
  • CWE-74

    Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')

  • CWE-77

    Improper Neutralization of Special Elements used in a Command ('Command Injection')

Sources

Status
PUBLISHED
Assigner
VulDB
Published
Updated
Aug 3, 2026, 7:58 PM
Reserved
Aug 3, 2026, 6:55 AM

View source JSON

Updated
Aug 3, 2026, 7:54 PM

JSON

Status
Deferred
Published
Aug 3, 2026, 2:16 PM
Modified
Oct 23, 2026, 9:10 PM

View source JSON

No data.

Updated
Sep 24, 2026, 7:00 PM

JSON