CVE-2026-18602

GL.iNet GL-MT3000 ovpn-client.so Native Plugin glc ovpn-client.get_recommend_config command injection

View on CVE.org
Published Aug 3, 2026 CVSS 4.0 · 9.3 Critical EPSS 3.6% KEV · Not listed
Description
A vulnerability was determined in GL.iNet GL-MT3000 up to 4.4.5. Affected is the function ovpn-client.get_recommend_config of the file /cgi-bin/glc of the component ovpn-client.so Native Plugin. Executing a manipulation of the argument Hostname can lead to command injection. The attack can be executed remotely. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure and confirmed the existence of the vulnerability.

Analysis

AI-generated

Technical impact

A bug in the GL.iNet GL‑MT3000 router’s ovpn‑client.so Native Plugin allows an attacker to manipulate the Hostname argument of the ovpn‑client.get_recommend_config command, resulting in arbitrary shell command execution and full system compromise.

Affected Systems

The vulnerability affects GL.iNet GL‑MT3000 routers running firmware versions up to 4.4.5. It is localized to the ovpn‑client.so component accessed via the /cgi‑bin/glc interface and does not affect other products or firmware releases beyond the specified version range.

Risk and Exploitability

The CVSS score of 9.3 indicates a critical severity, while the EPSS score is 4%, indicating a low but non‑zero likelihood of exploitation. The vulnerability is listed in the CVE database and the exploit has been publicly disclosed, meaning a remote attacker could trigger it by sending a specially crafted HTTP request to /cgi‑bin/glc with a malicious Hostname value. It is not yet listed in the CISA KEV catalog, but given its high impact, it remains a high‑risk issue. The weakness stems from command injection (CWE‑74 and CWE‑77) and can be exploited over the network without authentication if the web interface is exposed.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Upgrade GL.iNet GL‑MT3000 firmware to the latest version that contains the fix for the command injection issue.
  • If a patch is not yet available, block or restrict access to the /cgi‑bin/glc endpoint or disable the ovpn‑client.so functionality so that remote users cannot reach the vulnerable command.
  • Configure network or application firewalls to filter or limit the Hostname parameter, such as enforcing alphanumeric restrictions or rejecting payloads containing shell metacharacters.

Generated by OpenCVE AI on September 24, 2026 at 18:56 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories available
History
Type Values Removed Values Added
First Time appeared Gl-inet gl-mt3000
Vendors & Products Gl-inet gl-mt3000
Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'poc', 'Technical Impact': 'total'}, 'version': '2.0.3'}
Type Values Removed Values Added
Description A vulnerability was determined in GL.iNet GL-MT3000 up to 4.4.5. Affected is the function ovpn-client.get_recommend_config of the file /cgi-bin/glc of the component ovpn-client.so Native Plugin. Executing a manipulation of the argument Hostname can lead to command injection. The attack can be executed remotely. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure and confirmed the existence of the vulnerability.
Title GL.iNet GL-MT3000 ovpn-client.so Native Plugin glc ovpn-client.get_recommend_config command injection
First Time appeared Gl-inet
Gl-inet gl-mt3000 Firmware
Weaknesses CWE-74
CWE-77
CPEs cpe:2.3:o:gl-inet:gl-mt3000_firmware:*:*:*:*:*:*:*:*
Vendors & Products Gl-inet
Gl-inet gl-mt3000 Firmware
References
Metrics cvssV2_0

{'score': 10, 'vector': 'AV:N/AC:L/Au:N/C:C/I:C/A:C/E:POC/RL:ND/RC:C'}

cvssV3_0

{'score': 9.8, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P/RL:X/RC:R'}

cvssV3_1

{'score': 9.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P/RL:X/RC:R'}

cvssV4_0

{'score': 9.3, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P'}
Weaknesses
  • CWE-74

    Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')

  • CWE-77

    Improper Neutralization of Special Elements used in a Command ('Command Injection')

Sources

Status
PUBLISHED
Assigner
VulDB
Published
Updated
Aug 3, 2026, 4:48 PM
Reserved
Aug 3, 2026, 6:55 AM

View source JSON

Updated
Aug 3, 2026, 4:48 PM

JSON

Status
Deferred
Published
Aug 3, 2026, 5:16 PM
Modified
Oct 23, 2026, 9:10 PM

View source JSON

No data.

Updated
Sep 24, 2026, 7:00 PM

JSON