CVE-2026-18602 GL.iNet CVE debrief

Who should care

Defenders responsible for GL.iNet GL-MT3000 devices, particularly those running firmware up to 4.4.5, should assess exposure and verify the effectiveness of current security controls.

Why it matters

Defenders should prioritize verifying exposure of GL.iNet GL-MT3000 devices running firmware up to 4.4.5 and assess the effectiveness of current security controls to prevent command injection attacks.

• Verify exposure of GL.iNet GL-MT3000 devices running firmware up to 4.4.5
• Assess the effectiveness of current security controls to prevent command injection attacks
• Implement compensating controls to prevent command injection attacks

Technical summary

The vulnerability is located in the ovpn-client.get_recommend_config function of the /cgi-bin/glc file in the ovpn-client.so Native Plugin. An attacker can execute a command injection attack by manipulating the Hostname argument. This affects GL.iNet GL-MT3000 devices running firmware up to 4.4.5. Defenders should prioritize verifying exposure and assessing the effectiveness of current security controls to prevent command injection attacks. The attack can be executed remotely and has been publicly disclosed. The vendor confirmed the existence of the vulnerability.

Defensive priority

Defenders should prioritize verifying exposure of GL.iNet GL-MT3000 devices running firmware up to 4.4.5 and assess the effectiveness of current security controls.

Recommended defensive actions

• Verify exposure of GL.iNet GL-MT3000 devices running firmware up to 4.4.5
• Assess the effectiveness of current security controls
• Implement compensating controls to prevent command injection attacks
• Review vendor patch guidance
• Conduct exposure review
• Implement monitoring
• Update asset inventory

Evidence notes

The CVE record and NVD entry provide details on the vulnerability, including its description, CVSS score, and affected product. Additional information is available from Vuldb. The vulnerability affects GL.iNet GL-MT3000 devices running firmware up to 4.4.5. Defenders should verify exposure and assess security controls. Evidence is limited, and further verification is required.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.