Free Posture Self-Check

Back to Cyber Hose

Critical Command Injection Flaw Found in GL.iNet GL-MT3000 Devices

A critical remote command injection vulnerability affects GL.iNet GL-MT3000 devices up to firmware 4.4.5 with public exploit code.

2026-08-04 02:14 UTC

🕵️ RESEARCH & DEEP DIVES

Critical Command Injection Flaw Found in GL.iNet GL-MT3000 up to Firmware 4.4.5 CVE-2026-18686
A remote command injection vulnerability affects GL.iNet GL-MT3000 devices up to version 4.4.5.
- Applies to GL.iNet GL-MT3000 devices running firmware versions 4.4.0 through 4.4.5
- Vulnerability exists in nas-web.add_user function of /cgi-bin/glc component
- Allows unauthenticated remote attackers to perform command injection
- Exploit code is publicly available and confirmed by the vendor
- Severity rated critical with CVSS scores up to 9.8
Sources 📎 Coverage: cve.threatint.com · 📄 Original: cve.threatint.com · 👁 via CVE ThreatInt

🔓 CVEs & KEV

CVE-2026-11835 — CVSS — — Caliptra Update-Reset Secure-Boot Bypass via Attacker-Chosen AXI Staging Addr...
CVE-2026-11836 — CVSS — — Production Debug-Unlock Token Verification Missing Device BindingInsufficient...

Need help assessing your exposure?

Start with the free Posture Self-Check to see where you stand against the current threat landscape.

Free Posture Self-Check