EUVD-2026-52520

A weakness has been identified in GL.iNet GL-MT3000 up to 4.4.5. This issue affects the function removeprofile of the file /cgi-bin/glc of the component modem.so. This manipulation causes command injection. It is possible to initiate the attack remotely. The exploit has been made available to the...

CVE-2026-18686

A vulnerability was detected in GL.iNet GL-MT3000 up to 4.4.5. The affected element is the function nas-web.adduser of the file /cgi-bin/glc of the component nas-web RPC Wrapper. Performing a manipulation results in command injection. The attack can be initiated remotely. The exploit is now publi...

CVE-2026-18685

CVE-2026-18685 affects GL.iNet GL-MT3000 devices up to firmware 4.4.5, specifically the function set_upgrade in /cgi-bin/glc of the component modem.so. The issue enables remote command injection due to the underlying vulnerability; attack vector is network with no authentication and no user inter...

CVE-2026-18685

A security vulnerability has been detected in GL.iNet GL-MT3000 up to 4.4.5. Impacted is the function setupgrade of the file /cgi-bin/glc of the component modem.so. Such manipulation leads to command injection. It is possible to launch the attack remotely. The exploit has been disclosed publicly...

CVE-2026-18684

This CVE concerns GL.iNet GL-MT3000 devices (firmware up to 4.4.5). The issue lies in the function remove_profile of the file /cgi-bin/glc within component modem.so, enabling command injection. The vulnerability can be triggered remotely, and public exploit code exists. The vendor was informed an...

CVE-2026-18614

A vulnerability was found in GL-iNet GL-MT3000 up to 4.4.5. Impacted is the function s2s.enableechoserver of the file /cgi-bin/glc of the component s2s.so Native Plugin. Performing a manipulation of the argument port results in command injection. The attack may be initiated remotely. The exploit...

CVE-2026-18616

A vulnerability was identified in GL-iNet GL-MT3000 up to 4.4.5. The impacted element is the function server.setpeer of the file /cgi-bin/glc of the component wg-server.so Native Plugin. The manipulation of the argument publickey leads to command injection. Remote exploitation of the attack is...

CVE-2026-18613

A vulnerability has been found in GL-iNet GL-MT3000 up to 4.4.5. This issue affects the function plugins.setconfig of the file /cgi-bin/glc of the component plugins.so Native Plugin. Such manipulation leads to injection. The attack can be launched remotely. The exploit has been disclosed to the...

CVE-2026-18615

GL-iNet GL-MT3000 is affected through the wg-server.so Native Plugin glc, via the function wg-server.generate_publickey where manipulating the private_key argument leads to a command injection. The attack can be remote, and the exploit has been publicly disclosed. The provided documents do not sp...

EUVD-2026-52401

A vulnerability was determined in GL-iNet GL-MT3000 up to 4.4.5. The affected element is the function wg-server.generatepublickey of the file /cgi-bin/glc of the component wg-server.so Native Plugin. Executing a manipulation of the argument privatekey can lead to command injection. The attack may...

CVE-2026-18614 GL-iNet GL-MT3000 s2s.so Native Plugin glc s2s.enable_echo_server command injection

A vulnerability was found in GL-iNet GL-MT3000 up to 4.4.5. Impacted is the function s2s.enableechoserver of the file /cgi-bin/glc of the component s2s.so Native Plugin. Performing a manipulation of the argument port results in command injection. The attack may be initiated remotely. The exploit...

EUVD-2026-52397

A vulnerability has been found in GL-iNet GL-MT3000 up to 4.4.5. This issue affects the function plugins.setconfig of the file /cgi-bin/glc of the component plugins.so Native Plugin. Such manipulation leads to injection. The attack can be launched remotely. The exploit has been disclosed to the...

CVE-2026-18613 GL-iNet GL-MT3000 plugins.so Native Plugin glc plugins.set_config injection

A vulnerability has been found in GL-iNet GL-MT3000 up to 4.4.5. This issue affects the function plugins.setconfig of the file /cgi-bin/glc of the component plugins.so Native Plugin. Such manipulation leads to injection. The attack can be launched remotely. The exploit has been disclosed to the...

CVE-2026-18612

GL-iNet GL-MT3000 (firmware up to 4.4.5) exposes a command injection vulnerability in the Native Plugin plugins.so, specifically via the glc file’s plugins.remove_package/plugins.install_package functions. The flaw allows remote exploitation with no user interaction, and exploits have been publis...

EUVD-2026-52395

A flaw has been found in GL-iNet GL-MT3000 up to 4.4.5. This vulnerability affects the function plugins.removepackage/plugins.installpackage of the file /cgi-bin/glc of the component plugins.so Native Plugin. This manipulation causes command injection. The attack can be initiated remotely. The...

EUVD-2026-52335

A vulnerability was determined in GL.iNet GL-MT3000 up to 4.4.5. Affected is the function ovpn-client.getrecommendconfig of the file /cgi-bin/glc of the component ovpn-client.so Native Plugin. Executing a manipulation of the argument Hostname can lead to command injection. The attack can be...

CVE-2026-18602 GL.iNet GL-MT3000 ovpn-client.so Native Plugin glc ovpn-client.get_recommend_config command injection

A vulnerability was determined in GL.iNet GL-MT3000 up to 4.4.5. Affected is the function ovpn-client.getrecommendconfig of the file /cgi-bin/glc of the component ovpn-client.so Native Plugin. Executing a manipulation of the argument Hostname can lead to command injection. The attack can be...

CVE-2026-18602

GL.iNet GL-MT3000 (firmware up to 4.4.5) is affected by a vulnerability in the ovpn-client.so Native Plugin, specifically the glc component ovpn-client.get_recommend_config. A remote attacker can manipulate the Hostname argument to execute command injection. The issue is exploitable over the netw...

CVE-2026-18601

A vulnerability was found in GL.iNet GL-MT3000 up to 4.4.5. This impacts the function ovpn-client.checkconfig of the file /cgi-bin/glc of the component ovpn-client.so Native Plugin. Performing a manipulation of the argument filename results in command injection. Remote exploitation of the attack ...

CVE-2026-18599

A flaw has been found in GL.iNet GL-MT3000 up to 4.4.5. The impacted element is the function logread.setconfig of the file /usr/lib/oui-httpd/rpc/logread of the component Logread Lua RPC Plugin. This manipulation of the argument recordsize causes command injection. The exploit has been published...