CVE-2026-18684 GL.iNet CVE debrief

Who should care

Defenders responsible for GL.iNet GL-MT3000 devices, vulnerability management teams, security teams assessing remote exploitation risks, and operators managing firmware updates for these devices should assess exposure and prioritize verification and mitigation efforts. This includes reviewing current deployments, assessing potential impacts, and implementing necessary controls to mitigate the vulnerability.

Why it matters

A command injection vulnerability in GL.iNet GL-MT3000 up to 4.4.5 requires verification of exposure and prioritization of mitigation efforts.

• Verify exposure of GL.iNet GL-MT3000 devices running firmware up to 4.4.5
• Assess the need for updates or patches to address the command injection vulnerability
• Implement compensating controls to mitigate potential attacks

Technical summary

The vulnerability affects the function remove_profile of the file /cgi-bin/glc of the component modem.so in GL.iNet GL-MT3000 up to 4.4.5, allowing for command injection. This issue is remotely exploitable and has been made publicly available. The vendor has confirmed the vulnerability's existence. Technical details are based on CVE and NVD information; further verification is recommended to assess specific impacts and required mitigations within affected environments. Defenders should assess technical implications and prioritize mitigation efforts accordingly.

Defensive priority

Defenders should prioritize verifying exposure of GL.iNet GL-MT3000 devices running firmware up to 4.4.5 and assess the need for updates or compensating controls.

Recommended defensive actions

• Verify GL.iNet GL-MT3000 devices running firmware up to 4.4.5 are exposed to the vulnerability
• Assess the need for updates or patches to address the command injection vulnerability
• Implement compensating controls to mitigate potential attacks
• Review relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance

Evidence notes

The CVE record and NVD entry provide details on the vulnerability in GL.iNet GL-MT3000 devices. The vendor has confirmed the existence of the vulnerability. Evidence is limited to public CVE and NVD information. Defenders should verify exposure using available sources and assess potential impacts based on provided details. Limited source detail is available; explicit evidence limits apply.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.