Description
A vulnerability was determined in GL.iNet GL-MT3000 up to 4.4.5. Affected is the function ovpn-client.get_recommend_config of the file /cgi-bin/glc of the component ovpn-client.so Native Plugin. Executing a manipulation of the argument Hostname can lead to command injection. The attack can be executed remotely. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure and confirmed the existence of the vulnerability.
Published: 2026-08-03
Score: 9.3 Critical
EPSS: 2.0% Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

A bug in the GL.iNet GL‑MT3000 router’s ovpn‑client.so Native Plugin allows an attacker to manipulate the Hostname argument of the ovpn‑client.get_recommend_config command, resulting in arbitrary shell command execution and full system compromise.

Affected Systems

The vulnerability affects GL.iNet GL‑MT3000 routers running firmware versions up to 4.4.5. It is localized to the ovpn‑client.so component accessed via the /cgi‑bin/glc interface and does not affect other products or firmware releases beyond the specified version range.

Risk and Exploitability

The CVSS score of 9.3 indicates a critical severity, while the EPSS score is 2%, indicating a low but non‑zero likelihood of exploitation. The vulnerability is listed in the CVE database and the exploit has been publicly disclosed, meaning a remote attacker could trigger it by sending a specially crafted HTTP request to /cgi‑bin/glc with a malicious Hostname value. It is not yet listed in the CISA KEV catalog, but given its high impact, it remains a high‑risk issue. The weakness stems from command injection (CWE‑74 and CWE‑77) and can be exploited over the network without authentication if the web interface is exposed.

Generated by OpenCVE AI on August 4, 2026 at 21:02 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade GL.iNet GL‑MT3000 firmware to the latest version that contains the fix for the command injection issue.
  • If a patch is not yet available, block or restrict access to the /cgi‑bin/glc endpoint or disable the ovpn‑client.so functionality so that remote users cannot reach the vulnerable command.
  • Configure network or application firewalls to filter or limit the Hostname parameter, such as enforcing alphanumeric restrictions or rejecting payloads containing shell metacharacters.

Generated by OpenCVE AI on August 4, 2026 at 21:02 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Mon, 03 Aug 2026 18:45:00 +0000

Type Values Removed Values Added
First Time appeared Gl-inet gl-mt3000
Vendors & Products Gl-inet gl-mt3000

Mon, 03 Aug 2026 17:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'poc', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Mon, 03 Aug 2026 16:30:00 +0000

Type Values Removed Values Added
Description A vulnerability was determined in GL.iNet GL-MT3000 up to 4.4.5. Affected is the function ovpn-client.get_recommend_config of the file /cgi-bin/glc of the component ovpn-client.so Native Plugin. Executing a manipulation of the argument Hostname can lead to command injection. The attack can be executed remotely. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure and confirmed the existence of the vulnerability.
Title GL.iNet GL-MT3000 ovpn-client.so Native Plugin glc ovpn-client.get_recommend_config command injection
First Time appeared Gl-inet
Gl-inet gl-mt3000 Firmware
Weaknesses CWE-74
CWE-77
CPEs cpe:2.3:o:gl-inet:gl-mt3000_firmware:*:*:*:*:*:*:*:*
Vendors & Products Gl-inet
Gl-inet gl-mt3000 Firmware
References
Metrics cvssV2_0

{'score': 10, 'vector': 'AV:N/AC:L/Au:N/C:C/I:C/A:C/E:POC/RL:ND/RC:C'}

cvssV3_0

{'score': 9.8, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P/RL:X/RC:R'}

cvssV3_1

{'score': 9.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P/RL:X/RC:R'}

cvssV4_0

{'score': 9.3, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P'}

Subscriptions

Gl-inet Gl-mt3000 Gl-mt3000 Firmware
cve-icon MITRE

Status: PUBLISHED

Assigner: VulDB

Published:

Updated: 2026-08-03T16:48:22.144Z

Reserved: 2026-08-03T06:55:27.087Z

Link: CVE-2026-18602

cve-icon Vulnrichment

Updated: 2026-08-03T16:48:13.435Z

cve-icon NVD

Status : Deferred

Published: 2026-08-03T17:16:35.153

Modified: 2026-08-12T21:00:37.147

Link: CVE-2026-18602

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-08-04T21:15:03Z

Weaknesses
  • CWE-74

    Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')

  • CWE-77

    Improper Neutralization of Special Elements used in a Command ('Command Injection')