CVE-2026-18616

GL-iNet GL-MT3000 wg-server.so Native Plugin glc server.set_peer command injection

View on CVE.org
Published Aug 3, 2026 CVSS 4.0 · 9.3 Critical EPSS 3.6% KEV · Not listed
Description
A vulnerability was identified in GL-iNet GL-MT3000 up to 4.4.5. The impacted element is the function server.set_peer of the file /cgi-bin/glc of the component wg-server.so Native Plugin. The manipulation of the argument public_key leads to command injection. Remote exploitation of the attack is possible. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure and confirmed the existence of the vulnerability.

Analysis

AI-generated

Technical impact

The vulnerability is a command injection flaw located in the server.set_peer function of the wg‑server.so native plugin (cgi-bin/glc) on GL‑iNet GL‑MT3000 routers. Attackers can manipulate the public_key argument to inject arbitrary operating‑system commands, giving them full control of the device. The flaw is a classic input validation failure (CWE‑74/CWE‑77) and could compromise confidentiality, integrity, and availability of the affected router.

Affected Systems

The issue affects GL‑iNet GL‑MT3000 routers running firmware versions up to and including 4.4.5. No other vendors or product lines are currently known to be impacted.

Risk and Exploitability

The CVSS base score of 9.3 indicates extreme severity. Remote exploitation is possible, and an exploit is publicly available, with an EPSS score of 4%. The vulnerability is not yet listed in CISA KEV, but the combination of remote code execution and known public exploits makes it highly likely to be targeted soon. Attackers could reach the device over the network and trigger the command injection by crafted requests to /cgi-bin/glc with a malicious public_key payload.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Download and flash the latest firmware release that fixes the server.set_peer command injection.
  • If an update is unavailable or delayed, block the wg‑server.so service or restrict access to the /cgi-bin/glc endpoint using firewall or ACL rules.
  • Enable logging and monitor for anomalous requests containing the public_key parameter or unexpected shell commands; investigate any suspicious activity immediately.

Generated by OpenCVE AI on September 24, 2026 at 18:54 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories available
History
Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'poc', 'Technical Impact': 'total'}, 'version': '2.0.3'}
Type Values Removed Values Added
First Time appeared Gl-inet gl-mt3000
Vendors & Products Gl-inet gl-mt3000
Type Values Removed Values Added
Description A vulnerability was identified in GL-iNet GL-MT3000 up to 4.4.5. The impacted element is the function server.set_peer of the file /cgi-bin/glc of the component wg-server.so Native Plugin. The manipulation of the argument public_key leads to command injection. Remote exploitation of the attack is possible. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure and confirmed the existence of the vulnerability.
Title GL-iNet GL-MT3000 wg-server.so Native Plugin glc server.set_peer command injection
First Time appeared Gl-inet
Gl-inet gl-mt3000 Firmware
Weaknesses CWE-74
CWE-77
CPEs cpe:2.3:o:gl-inet:gl-mt3000_firmware:*:*:*:*:*:*:*:*
Vendors & Products Gl-inet
Gl-inet gl-mt3000 Firmware
References
Metrics cvssV2_0

{'score': 10, 'vector': 'AV:N/AC:L/Au:N/C:C/I:C/A:C/E:POC/RL:ND/RC:C'}

cvssV3_0

{'score': 9.8, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P/RL:X/RC:R'}

cvssV3_1

{'score': 9.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P/RL:X/RC:R'}

cvssV4_0

{'score': 9.3, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P'}
Weaknesses
  • CWE-74

    Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')

  • CWE-77

    Improper Neutralization of Special Elements used in a Command ('Command Injection')

Sources

Status
PUBLISHED
Assigner
VulDB
Published
Updated
Aug 4, 2026, 5:13 PM
Reserved
Aug 3, 2026, 7:33 AM

View source JSON

Updated
Aug 4, 2026, 5:13 PM

JSON

Status
Deferred
Published
Aug 3, 2026, 7:16 PM
Modified
Oct 23, 2026, 9:10 PM

View source JSON

No data.

Updated
Sep 24, 2026, 7:00 PM

JSON