CVE-2026-18612

GL-iNet GL-MT3000 plugins.so Native Plugin glc plugins.install_package command injection

View on CVE.org
Published Aug 3, 2026 CVSS 4.0 · 9.3 Critical EPSS 4.0% KEV · Not listed
Description
A flaw has been found in GL-iNet GL-MT3000 up to 4.4.5. This vulnerability affects the function plugins.remove_package/plugins.install_package of the file /cgi-bin/glc of the component plugins.so Native Plugin. This manipulation causes command injection. The attack can be initiated remotely. The exploit has been published and may be used. The vendor was contacted early about this disclosure and confirmed the existence of the vulnerability.

Analysis

AI-generated

Technical impact

A flaw in GL-iNet GL-MT3000 firmware up to version 4.4.5 allows an attacker to inject arbitrary shell commands through the plugins.remove_package and plugins.install_package functions in the glc component. The vulnerability is a classic command injection flaw, classified as CWE-74 and CWE-77, enabling remote execution of system commands on the device. It can lead to full compromise of the device, allowing attackers to gain persistent access, exfiltrate data, or use the router as a foothold for further network attacks.

Affected Systems

GL-iNet GL-MT3000 routers running firmware versions up to 4.4.5 are affected, specifically those using the native plugins.so module accessed via the /cgi-bin/glc interface.

Risk and Exploitability

The CVSS score of 9.3 indicates critical severity. The EPSS score is 4%, indicating a low but non-zero exploitation probability, but the vulnerability has an exposed exploit that has been published, implying that attacks are realistic. The issue remains outside the CISA KEV catalog. Because the attack vector is remote—any party can reach the vulnerable CGI endpoint—an attacker does not need local access to exploit it.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Apply the latest GL-iNet GL-MT3000 firmware update that removes the vulnerable plugins.so module or applies the official patch.
  • Restrict access to the /cgi-bin/glc web interface by firewalling it to trusted IPs or disabling the web console entirely if no patch is available.
  • Monitor web server logs for suspicious glc requests and enforce strict input validation on any data passed to the plugin functions to detect and prevent command injection attempts.

Generated by OpenCVE AI on September 24, 2026 at 18:55 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories available
History
Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'poc', 'Technical Impact': 'total'}, 'version': '2.0.3'}
Type Values Removed Values Added
First Time appeared Gl-inet gl-mt3000
Vendors & Products Gl-inet gl-mt3000
Type Values Removed Values Added
Description A flaw has been found in GL-iNet GL-MT3000 up to 4.4.5. This vulnerability affects the function plugins.remove_package/plugins.install_package of the file /cgi-bin/glc of the component plugins.so Native Plugin. This manipulation causes command injection. The attack can be initiated remotely. The exploit has been published and may be used. The vendor was contacted early about this disclosure and confirmed the existence of the vulnerability.
Title GL-iNet GL-MT3000 plugins.so Native Plugin glc plugins.install_package command injection
First Time appeared Gl-inet
Gl-inet gl-mt3000 Firmware
Weaknesses CWE-74
CWE-77
CPEs cpe:2.3:o:gl-inet:gl-mt3000_firmware:*:*:*:*:*:*:*:*
Vendors & Products Gl-inet
Gl-inet gl-mt3000 Firmware
References
Metrics cvssV2_0

{'score': 10, 'vector': 'AV:N/AC:L/Au:N/C:C/I:C/A:C/E:POC/RL:ND/RC:C'}

cvssV3_0

{'score': 9.8, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P/RL:X/RC:R'}

cvssV3_1

{'score': 9.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P/RL:X/RC:R'}

cvssV4_0

{'score': 9.3, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P'}
Weaknesses
  • CWE-74

    Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')

  • CWE-77

    Improper Neutralization of Special Elements used in a Command ('Command Injection')

Sources

Status
PUBLISHED
Assigner
VulDB
Published
Updated
Aug 3, 2026, 8:13 PM
Reserved
Aug 3, 2026, 7:33 AM

View source JSON

Updated
Aug 3, 2026, 8:13 PM

JSON

Status
Deferred
Published
Aug 3, 2026, 6:16 PM
Modified
Oct 23, 2026, 9:10 PM

View source JSON

No data.

Updated
Sep 24, 2026, 7:00 PM

JSON