The vulnerability is a command injection in the ovpn-client.check_config function of the /cgi-bin/glc script in the native plugin ovpn-client.so on GL.iNet GL‑MT3000 routers. A malformed filename parameter allows a remote attacker to execute arbitrary shell commands on the device, potentially leading to full system compromise. The flaw exists because the input is passed directly to the operating system without proper sanitization, matching CWE‑74 (Command Injection) and CWE‑77 (Improper Command Execution).

Affected devices are GL.iNet GL‑MT3000 routers running firmware versions up to and including 4.4.5. The issue is tracked in the CVE record for CVE‑2026‑18601 and has been disclosed publicly.

The CVSS score of 9.3 indicates critical severity, and the EPSS score of 2% implies a low but non‑zero likelihood of exploitation. The vulnerability is remotely exploitable and a publicly available exploit exists. The likely attack vector is a remote HTTP request to the /cgi-bin/glc endpoint, which, if the device is reachable from the internet or an untrusted network, can be used to inject commands. The vendor has not listed the issue in the CISA KEV catalog.