The vulnerability of the nas-web.add_user function in the microprogramming software for GL.iNet GL-MT3000 allows a attacker to execute arbitrary commands.

The vulnerability of the nas-web.adduser function in the GL.iNet GL-MT3000 router microprogramming system is related to the failure to take measures to neutralize special elements in the output data. Exploiting this vulnerability allows a remote attacker to execute arbitrary commands...

EUVD-2026-52537

A security vulnerability has been detected in GL.iNet GL-MT3000 up to 4.4.5. Impacted is the function setupgrade of the file /cgi-bin/glc of the component modem.so. Such manipulation leads to command injection. It is possible to launch the attack remotely. The exploit has been disclosed publicly...

CVE-2026-18615

A vulnerability was determined in GL-iNet GL-MT3000 up to 4.4.5. The affected element is the function wg-server.generatepublickey of the file /cgi-bin/glc of the component wg-server.so Native Plugin. Executing a manipulation of the argument privatekey can lead to command injection. The attack may...

CVE-2026-18616 GL-iNet GL-MT3000 wg-server.so Native Plugin glc server.set_peer command injection

A vulnerability was identified in GL-iNet GL-MT3000 up to 4.4.5. The impacted element is the function server.setpeer of the file /cgi-bin/glc of the component wg-server.so Native Plugin. The manipulation of the argument publickey leads to command injection. Remote exploitation of the attack is...

CVE-2026-18615

A vulnerability was determined in GL-iNet GL-MT3000 up to 4.4.5. The affected element is the function wg-server.generatepublickey of the file /cgi-bin/glc of the component wg-server.so Native Plugin. Executing a manipulation of the argument privatekey can lead to command injection. The attack may...

CVE-2026-18602

A vulnerability was determined in GL.iNet GL-MT3000 up to 4.4.5. Affected is the function ovpn-client.getrecommendconfig of the file /cgi-bin/glc of the component ovpn-client.so Native Plugin. Executing a manipulation of the argument Hostname can lead to command injection. The attack can be...

CVE-2026-18598

A vulnerability was detected in GL.iNet GL-MT3000 up to 4.4.5. The affected element is the function logread.getsystemlog of the file /usr/lib/oui-httpd/rpc/logread of the component Logread Lua RPC plugin. The manipulation of the argument module results in command injection. The attack can be...

EUVD-2026-52271

A vulnerability was found in GL.iNet GL-MT3000 up to 4.4.5. This impacts the function ovpn-client.checkconfig of the file /cgi-bin/glc of the component ovpn-client.so Native Plugin. Performing a manipulation of the argument filename results in command injection. Remote exploitation of the attack ...

EUVD-2026-52267

A vulnerability has been found in GL.iNet GL-MT3000 up to 4.4.5. This affects the function network.switchinfo/network.switchstatus of the file /usr/lib/oui-httpd/rpc/network of the component Network Lua RPC Plugin. Such manipulation of the argument switch leads to command injection. The attack ma...

PT-2026-67396

A vulnerability has been found in GL.iNet GL-MT3000 up to 4.4.5. This affects the function network.switch info/network.switch status of the file /usr/lib/oui-httpd/rpc/network of the component Network Lua RPC Plugin. Such manipulation of the argument switch leads to command injection. The attack...

PT-2026-67482

Name of the Vulnerable Software and Affected Versions GL-iNet GL-MT3000 versions prior to 4.4.6 Description Command injection is possible via remote exploitation in the wg-server.so Native Plugin. The issue exists within the server.set peer function located in the /cgi-bin/glc file, where imprope...

PT-2026-49110

Name of the Vulnerable Software and Affected Versions GL.iNet GL-MT3000 versions prior to 4.7 Description Remote command injection is possible within the Online Firmware Upgrade Handler component. The issue resides in the /usr/bin/one click upgrade file, where improper handling of functionality...

The vulnerability of the dlopen() function in the library /usr/lib/oui-httpd/rpc of the microprogramming software for routers GL.iNet GL-MT3000 allows a attacker to execute arbitrary commands.

The vulnerability of the dlopen function in the library /usr/lib/oui-httpd/rpc of the microprogramming software for routers GL.iNet GL-MT3000 is related to the lack of measures to neutralize special elements. Exploiting this vulnerability allows a remote attacker to inject arbitrary commands...

The vulnerability of the OpenVPN Client Import Workflow component of the GL.iNet GL-MT3000 router microsystem allows a intruder to inject arbitrary commands.

The vulnerability of the OpenVPN Client Import Workflow component of the GL.iNet GL-MT3000 router microsystem lies in the lack of measures to neutralize specific elements. Exploiting this vulnerability allows a remote attacker to inject arbitrary commands...

CVE-2026-11447

A security flaw has been discovered in GL.iNet GL-MT3000 up to 4.4.5. Impacted is the function iwinfobackend of the file iwinfo.so of the component MTK Backend. The manipulation of the argument device results in command injection. The attack can be executed remotely. The exploit has been released...

EUVD-2026-34981

A vulnerability was detected in GL.iNet GL-MT3000 4.4.5. This affects the function dlopen in the library /usr/lib/oui-httpd/rpc/ of the component Path Normalization Handler. Performing a manipulation of the argument devname results in command injection. It is possible to initiate the attack...

PT-2026-47169

A weakness has been identified in GL.iNet GL-MT3000 up to 4.4.5. The affected element is the function realpath of the file /rpc of the component Minidlna Service. This manipulation of the argument kube. set causes command injection. The attack is possible to be carried out remotely. Upgrading to...

GL.iNet GL-MT3000 命令注入漏洞

GL.iNet GL-MT3000 is a portable travel router from the company GL.iNet, which supports Wi-Fi 6 and VPN functions. Versions of GL.iNet GL-MT3000 with a version number of 4.4.5 or earlier have a command injection vulnerability. This vulnerability stems from the incorrect handling of the parameter...

GL-iNet GL-AR300M16 安全漏洞

GL-iNet GL-AR300M16 is a portable mini router produced by the Chinese company GL-iNet. The GL-iNet GL-AR300M16 v4.3.11 version contains a security vulnerability. This vulnerability stems from the string port parameter in the enableechoserver function, which allows for command injection, potential...

GL-iNet GL-AR300M16 安全漏洞

GL-iNet GL-AR300M16 is a portable mini router produced by the Chinese company GL-iNet. The GL-iNet GL-AR300M16 v4.3.11 version contains a security vulnerability. This vulnerability stems from a command injection vulnerability in the setconfig function, which may allow for the execution of arbitra...