Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

CVE-2026-18612: GL-iNet GL-MT3000 plugins.so plugin command injection risk

CVE-2026-18612 · published 1 month ago

Summary

An attacker can remotely execute malicious commands on a GL-iNet GL-MT3000 router by exploiting a flaw in the plugin installation process. This could allow the attacker to gain control of the router. We recommend updating to the latest version of the router's software to fix this issue.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software

Vendor	Product	Affected versions
gl-inet	gl-mt3000	4.4.0

Original advisory text

A flaw has been found in GL-iNet GL-MT3000 up to 4.4.5. This vulnerability affects the function plugins.remove_package/plugins.install_package of the file /cgi-bin/glc of the component plugins.so Native Plugin. This manipulation causes command injection. The attack can be initiated remotely. The exploit has been published and may be used. The vendor was contacted early about this disclosure and confirmed the existence of the vulnerability.

References

https://vuldb.com/vuln/385532 vdb-entry technical-description
https://vuldb.com/vuln/385532/cti signature permissions-required
https://vuldb.com/cve/CVE-2026-18612 third-party-advisory
https://vuldb.com/submit/851553 third-party-advisory
https://vuldb.com/submit/851596 third-party-advisory
https://vuldb.com/submit/851597 third-party-advisory
https://vuldb.com/submit/851600 third-party-advisory
https://github.com/StrTzz123/iot_vul/blob/main/GL-iNet/MT3000/4.4.5/plugins_pack... exploit

Severity

8.9 High

CVSS 3.1: 9.8 (MITRE)

Exploitation

EPSS 4%

Type

CWE-77Command Injection

CWE-74Injection

Timeline

Published3 Aug 2026

Updated25 Sep 2026

First seen3 Aug 2026

Sources

CVE-2026-18612 · NVD

CVE-2026-18612 · MITRE

Track software like this

Free during beta