CVE-2026-18600 GL.iNet CVE debrief

Who should care

Network administrators and security teams responsible for managing IoT devices, particularly those using GL.iNet GL-MT3000 devices in their infrastructure, should assess their exposure to this vulnerability. Given the potential for remote exploitation, defenders should prioritize verifying the firmware versions of these devices and consider necessary remediation steps.

Why it matters

CVE-2026-18600 is a command injection vulnerability in GL.iNet GL-MT3000 devices running firmware up to 4.4.5. Network administrators and IoT security teams should verify exposure, prioritize updates or patches, and consider compensating controls. The vulnerability allows remote exploitation, and public exploit information is available. However, specific details about confirmed exploitation and affected versions beyond 4.4.5 are limited.

• Remote exploitation of vulnerable GL.iNet GL-MT3000 devices could lead to unauthorized command execution.
• Successful exploitation may allow attackers to gain control over affected devices.
• Defenders need to verify exposure and prioritize remediation to prevent potential exploitation.
• Inventory checks and firmware updates are crucial to mitigate this vulnerability.

Technical summary

The Network Lua RPC Plugin in GL.iNet GL-MT3000 devices up to firmware version 4.4.5 contains a vulnerability in the network.switch_info/network.switch_status function of the /usr/lib/oui-httpd/rpc/network file. This vulnerability allows for command injection via the switch argument, enabling remote exploitation. The issue has been publicly disclosed, and the vendor has confirmed its existence. Affected product deployments should be identified in managed environments, and defenders should assess the need for updates or patches. Network administrators and security teams responsible for IoT devices should evaluate their inventory for potential vulnerability and consider compensating controls until an official fix

Defensive priority

Defenders should prioritize verifying exposure of GL.iNet GL-MT3000 devices running firmware up to 4.4.5 and assess the need for updates or patches. Network administrators and security teams responsible for IoT devices should evaluate their inventory for potential vulnerability and consider compensating controls until an official fix is available.

Recommended defensive actions

• Verify GL.iNet GL-MT3000 firmware versions up to 4.4.5 for potential vulnerability
• Assess network exposure and consider compensating controls
• Monitor for publicly available patches or updates from the vendor
• Evaluate inventory for GL.iNet GL-MT3000 devices and prioritize remediation
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented

Evidence notes

The CVE record and NVD entry provide details on the vulnerability in GL.iNet GL-MT3000 devices. Publicly available exploit information and vendor confirmation support the existence of this vulnerability. However, specific details about affected versions beyond 4.4.5 and confirmed exploitation are limited.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.