Description
A flaw has been found in GL-iNet GL-MT3000 up to 4.4.5. This vulnerability affects the function plugins.remove_package/plugins.install_package of the file /cgi-bin/glc of the component plugins.so Native Plugin. This manipulation causes command injection. The attack can be initiated remotely. The exploit has been published and may be used. The vendor was contacted early about this disclosure and confirmed the existence of the vulnerability.
Published: 2026-08-03
Score: 9.3 Critical
EPSS: 2.2% Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

A flaw in GL-iNet GL-MT3000 firmware up to version 4.4.5 allows an attacker to inject arbitrary shell commands through the plugins.remove_package and plugins.install_package functions in the glc component. The vulnerability is a classic command injection flaw, classified as CWE-74 and CWE-77, enabling remote execution of system commands on the device. It can lead to full compromise of the device, allowing attackers to gain persistent access, exfiltrate data, or use the router as a foothold for further network attacks.

Affected Systems

GL-iNet GL-MT3000 routers running firmware versions up to 4.4.5 are affected, specifically those using the native plugins.so module accessed via the /cgi-bin/glc interface.

Risk and Exploitability

The CVSS score of 9.3 indicates critical severity. The EPSS score is 2%, indicating a low but non-zero exploitation probability, but the vulnerability has an exposed exploit that has been published, implying that attacks are realistic. The issue remains outside the CISA KEV catalog. Because the attack vector is remote—any party can reach the vulnerable CGI endpoint—an attacker does not need local access to exploit it.

Generated by OpenCVE AI on August 4, 2026 at 20:59 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Apply the latest GL-iNet GL-MT3000 firmware update that removes the vulnerable plugins.so module or applies the official patch.
  • Restrict access to the /cgi-bin/glc web interface by firewalling it to trusted IPs or disabling the web console entirely if no patch is available.
  • Monitor web server logs for suspicious glc requests and enforce strict input validation on any data passed to the plugin functions to detect and prevent command injection attempts.

Generated by OpenCVE AI on August 4, 2026 at 20:59 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Mon, 03 Aug 2026 21:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'poc', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Mon, 03 Aug 2026 20:00:00 +0000

Type Values Removed Values Added
First Time appeared Gl-inet gl-mt3000
Vendors & Products Gl-inet gl-mt3000

Mon, 03 Aug 2026 18:00:00 +0000

Type Values Removed Values Added
Description A flaw has been found in GL-iNet GL-MT3000 up to 4.4.5. This vulnerability affects the function plugins.remove_package/plugins.install_package of the file /cgi-bin/glc of the component plugins.so Native Plugin. This manipulation causes command injection. The attack can be initiated remotely. The exploit has been published and may be used. The vendor was contacted early about this disclosure and confirmed the existence of the vulnerability.
Title GL-iNet GL-MT3000 plugins.so Native Plugin glc plugins.install_package command injection
First Time appeared Gl-inet
Gl-inet gl-mt3000 Firmware
Weaknesses CWE-74
CWE-77
CPEs cpe:2.3:o:gl-inet:gl-mt3000_firmware:*:*:*:*:*:*:*:*
Vendors & Products Gl-inet
Gl-inet gl-mt3000 Firmware
References
Metrics cvssV2_0

{'score': 10, 'vector': 'AV:N/AC:L/Au:N/C:C/I:C/A:C/E:POC/RL:ND/RC:C'}

cvssV3_0

{'score': 9.8, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P/RL:X/RC:R'}

cvssV3_1

{'score': 9.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P/RL:X/RC:R'}

cvssV4_0

{'score': 9.3, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P'}

Subscriptions

Gl-inet Gl-mt3000 Gl-mt3000 Firmware
cve-icon MITRE

Status: PUBLISHED

Assigner: VulDB

Published:

Updated: 2026-08-03T20:13:29.372Z

Reserved: 2026-08-03T07:33:17.223Z

Link: CVE-2026-18612

cve-icon Vulnrichment

Updated: 2026-08-03T20:13:25.587Z

cve-icon NVD

Status : Deferred

Published: 2026-08-03T18:16:38.450

Modified: 2026-08-12T21:00:37.147

Link: CVE-2026-18612

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-08-04T21:00:11Z

Weaknesses
  • CWE-74

    Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')

  • CWE-77

    Improper Neutralization of Special Elements used in a Command ('Command Injection')