Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
9.8

GL-iNet GL-AR300M16 Firmware Upgrade Vulnerability Allows Command Execution

CVE-2026-26792 · published 7 months ago
Summary

The GL-iNet GL-AR300M16's firmware upgrade feature is vulnerable to hacking. Attackers can exploit this vulnerability by sending specially crafted input, allowing them to execute unauthorized commands on the device. Firmware updates should be reviewed and validated before applying to avoid potential security risks.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software
VendorProductAffected versions
gl-inet ar300m16_firmware 4.3.11
cpe:2.3:o:gl-inet:ar300m16_firmware:4.3.11:*:*:*:*:*:*:*
Original advisory text
GL-iNet GL-AR300M16 v4.3.11 was discovered to contain multiple command injection vulnerabilities in the set_upgrade function via the modem_url, target_version, current_version, firmware_upload, has...
GL-iNet GL-AR300M16 v4.3.11 was discovered to contain multiple command injection vulnerabilities in the set_upgrade function via the modem_url, target_version, current_version, firmware_upload, hash_type, hash_value, and upgrade_type parameters. These vulnerabilities allow attackers to execute arbitrary commands via a crafted input.
References
Fix within
Internet-facing 3 days
Internal 60 days
  • Not known to be exploited
  • Can be exploited automatically
  • Gives an attacker full control
Severity
9.8 Critical
Exploitation
3% chance of attack within 30 days
Type
CWE-77Command Injection
Timeline
Published12 Mar 2026
Updated29 Oct 2026
First seen12 Mar 2026
Sources
CVE-2026-26792 · NVD
Track software like this
Free during beta