CVE-2026-18612

GL-iNet GL-MT3000 (firmware up to 4.4.5) exposes a command injection vulnerability in the Native Plugin plugins.so, specifically via the glc file’s plugins.remove_package/plugins.install_package functions. The flaw allows remote exploitation with no user interaction, and exploits have been publis...