PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-18615 GL-iNet CVE debrief

A vulnerability was determined in GL-iNet GL-MT3000 up to 4.4.5. The affected element is the function wg-server.generate_publickey of the file /cgi-bin/glc of the component wg-server.so Native Plugin. Executing a manipulation of the argument private_key can lead to command injection. The attack may be launched remotely. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure and confirmed the existence of the vulnerability.

Vendor
GL-iNet
Product
GL-MT3000
CVSS
HIGH 8.9
CISA KEV
Not listed in stored evidence
Original CVE published
2026-08-03
Original CVE updated
2026-10-23
Advisory published
2026-08-03
Advisory updated
2026-10-23

Who should care

Defenders responsible for GL-iNet GL-MT3000 devices, particularly those in IoT or network security roles, should assess exposure and implement necessary security controls. This includes operators, platform administrators, vulnerability management teams, and security teams who need to verify exposure and implement compensating controls to prevent command injection attacks.

Why it matters

Defenders should prioritize verifying exposure of GL-iNet GL-MT3000 devices running firmware up to 4.4.5 and assess the effectiveness of existing security controls to prevent remote command injection attacks.

  • Remote command injection attacks may be possible
  • Verification of exposure and security control effectiveness is necessary
  • Existing security controls may not prevent exploitation

Technical summary

The vulnerability is caused by a command injection issue in the wg-server.generate_publickey function of the /cgi-bin/glc file in the wg-server.so Native Plugin. This can be exploited remotely by manipulating the private_key argument. The affected product, GL-iNet GL-MT3000, is used in IoT and network security roles. Defenders should assess the effectiveness of existing security controls to prevent remote command injection attacks. The CVE record and NVD entry provide details on the vulnerability, including its description, CVSS score, and affected product.

Defensive priority

Defenders should prioritize verifying exposure of GL-iNet GL-MT3000 devices running firmware up to 4.4.5 and assess the effectiveness of existing security controls.

Recommended defensive actions

  • Verify exposure of GL-iNet GL-MT3000 devices running firmware up to 4.4.5
  • Assess the effectiveness of existing security controls
  • Implement compensating controls to prevent command injection attacks
  • Review vendor patch guidance for GL-iNet GL-MT3000 devices
  • Conduct exposure review for GL-iNet GL-MT3000 devices in IoT or network security roles
  • Implement monitoring for potential command injection attacks
  • Track exceptions and retest remediated assets

Evidence notes

The CVE record and NVD entry provide details on the vulnerability, including its description, CVSS score, and affected product. Additional information is available from source references, including a GitHub repository and Vuldb entries.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-18615 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-18615

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-18615 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-18615

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.