Description
A vulnerability was detected in GL.iNet GL-MT3000 up to 4.4.5. The affected element is the function nas-web.add_user of the file /cgi-bin/glc of the component nas-web RPC Wrapper. Performing a manipulation results in command injection. The attack can be initiated remotely. The exploit is now public and may be used. The vendor was contacted early about this disclosure and confirmed the existence of the vulnerability.
Published: 2026-08-04
Score: 9.3 Critical
EPSS: 2.6% Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

The GL.iNet GL‑MT3000 firmware contains a command injection flaw in the nas‑web.add_user RPC function located in /cgi-bin/glc. This vulnerability allows an unauthenticated attacker to craft input that is executed as system commands on the device, giving full control over the device’s operating system and compromising confidentiality, integrity, and availability of the device.

Affected Systems

All GL.iNet GL‑MT3000 routers with firmware versions up to and including 4.4.5 are vulnerable. Devices beyond 4.4.5 are presumed to be unaffected until a vendor fix is released.

Risk and Exploitability

The CVSS score of 9.3 marks this flaw as critical. The EPSS score of 0.02607 indicates a low to moderate probability that exploitation attempts will occur, yet evidence of public exploit code exists. The flaw is not listed in the CISA KEV catalog, but it can be accessed remotely, typically over the Internet or a compromised local network, by sending a specially crafted request to the nas‑web.add_user endpoint.

Generated by OpenCVE AI on August 4, 2026 at 21:34 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • When an official firmware update that removes the command injection flaw is released, install it immediately.
  • If no patch is currently available, reconfigure the device or firewall rules to disable or restrict access to the nas‑web.add_user RPC endpoint, or disable the entirety of the nas‑web service.
  • Block external network access to the nas‑web RPC interface by permitting only trusted local‑network addresses in firewall or router policies.

Generated by OpenCVE AI on August 4, 2026 at 21:34 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Tue, 04 Aug 2026 16:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'poc', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Tue, 04 Aug 2026 03:15:00 +0000

Type Values Removed Values Added
First Time appeared Gl-inet gl-mt3000
Vendors & Products Gl-inet gl-mt3000

Tue, 04 Aug 2026 00:15:00 +0000

Type Values Removed Values Added
Description A vulnerability was detected in GL.iNet GL-MT3000 up to 4.4.5. The affected element is the function nas-web.add_user of the file /cgi-bin/glc of the component nas-web RPC Wrapper. Performing a manipulation results in command injection. The attack can be initiated remotely. The exploit is now public and may be used. The vendor was contacted early about this disclosure and confirmed the existence of the vulnerability.
Title GL.iNet GL-MT3000 nas-web RPC Wrapper glc nas-web.add_user command injection
First Time appeared Gl-inet
Gl-inet gl-mt3000 Firmware
Weaknesses CWE-74
CWE-77
CPEs cpe:2.3:o:gl-inet:gl-mt3000_firmware:*:*:*:*:*:*:*:*
Vendors & Products Gl-inet
Gl-inet gl-mt3000 Firmware
References
Metrics cvssV2_0

{'score': 10, 'vector': 'AV:N/AC:L/Au:N/C:C/I:C/A:C/E:POC/RL:ND/RC:C'}

cvssV3_0

{'score': 9.8, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P/RL:X/RC:R'}

cvssV3_1

{'score': 9.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P/RL:X/RC:R'}

cvssV4_0

{'score': 9.3, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P'}

Subscriptions

Gl-inet Gl-mt3000 Gl-mt3000 Firmware
cve-icon MITRE

Status: PUBLISHED

Assigner: VulDB

Published:

Updated: 2026-08-04T15:04:21.037Z

Reserved: 2026-08-03T15:50:09.485Z

Link: CVE-2026-18686

cve-icon Vulnrichment

Updated: 2026-08-04T13:27:25.322Z

cve-icon NVD

Status : Deferred

Published: 2026-08-04T00:16:40.520

Modified: 2026-08-12T20:59:00.027

Link: CVE-2026-18686

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-08-04T21:45:04Z

Weaknesses
  • CWE-74

    Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')

  • CWE-77

    Improper Neutralization of Special Elements used in a Command ('Command Injection')