These pages are published after PatchSiren validates generated defensive summaries against stored public CVE and source evidence.
A vulnerability was detected in GL.iNet GL-MT3000 up to 4.4.5. The affected element is the function nas-web.add_user of the file /cgi-bin/glc of the component nas-web RPC Wrapper. Performing a manipulation results in command injection. The attack can be initiated remotely. The exploit is now public and may be used. This vulnerability allows remote attackers to execute arbitrary commands, potentially leadi [truncated]
A security vulnerability has been detected in GL.iNet GL-MT3000 up to 4.4.5. The function set_upgrade of the file /cgi-bin/glc of the component modem.so is impacted, leading to command injection. The attack can be launched remotely. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure and confirmed the existence of the vulnerability.
A weakness has been identified in GL.iNet GL-MT3000 up to 4.4.5. This issue affects the function remove_profile of the file /cgi-bin/glc of the component modem.so. This manipulation causes command injection. It is possible to initiate the attack remotely. The exploit has been made available to the public and could be used for attacks. The vendor was contacted early about this disclosure and confirmed the [truncated]
A vulnerability was identified in GL-iNet GL-MT3000 up to 4.4.5. The impacted element is the function server.set_peer of the file /cgi-bin/glc of the component wg-server.so Native Plugin. The manipulation of the argument public_key leads to command injection. Remote exploitation of the attack is possible. The exploit is publicly available and might be used.
A vulnerability was determined in GL-iNet GL-MT3000 up to 4.4.5. The affected element is the function wg-server.generate_publickey of the file /cgi-bin/glc of the component wg-server.so Native Plugin. Executing a manipulation of the argument private_key can lead to command injection. The attack may be launched remotely. The exploit has been publicly disclosed and may be utilized. The vendor was contacted [truncated]
A vulnerability was found in GL-iNet GL-MT3000 up to 4.4.5. The function s2s.enable_echo_server of the file /cgi-bin/glc of the component s2s.so Native Plugin is impacted. Performing a manipulation of the argument port results in command injection. The attack may be initiated remotely. The exploit has been made public and could be used. Defenders should assess exposure and verify compensating controls for [truncated]
A vulnerability was found in GL-iNet GL-MT3000 up to 4.4.5 in the plugins.set_config function of /cgi-bin/glc, leading to injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The vendor confirmed the existence of the vulnerability. Defenders should assess exposure and verify security controls for GL-iNet GL-MT3000 devices running firmware up to 4.4. [truncated]
A flaw in GL-iNet GL-MT3000 up to 4.4.5 allows remote command injection via the plugins.so Native Plugin. The CVE record was published on 2026-08-03T18:16:38.450Z and has not been modified since then. The NVD entry is currently Deferred. Defenders should assess exposure and verify compensating controls for GL-iNet GL-MT3000 devices. The vulnerability affects the function plugins.remove_package/plugins.ins [truncated]
A vulnerability was determined in GL.iNet GL-MT3000 up to 4.4.5. Affected is the function ovpn-client.get_recommend_config of the file /cgi-bin/glc of the component ovpn-client.so Native Plugin. Executing a manipulation of the argument Hostname can lead to command injection. The attack can be executed remotely. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early abo [truncated]
A vulnerability was found in GL.iNet GL-MT3000 up to 4.4.5. This impacts the function ovpn-client.check_config of the file /cgi-bin/glc of the component ovpn-client.so Native Plugin. Performing a manipulation of the argument filename results in command injection. Remote exploitation of the attack is possible. The exploit has been made public and could be used.
A vulnerability was found in GL.iNet GL-MT3000 up to 4.4.5 in the Network Lua RPC Plugin, specifically in the network.switch_info/network.switch_status function of the /usr/lib/oui-httpd/rpc/network file, which allows for command injection via the switch argument. This issue can be exploited remotely. The exploit has been publicly disclosed and may be used. The vendor has confirmed the vulnerability's existence.
A command injection vulnerability exists in GL.iNet GL-MT3000 devices running firmware up to version 4.4.5. The vulnerability is located in the logread.set_config function of the /usr/lib/oui-httpd/rpc/logread file, part of the Logread Lua RPC Plugin. An attacker can exploit this vulnerability by manipulating the record_size argument, potentially leading to command injection. The exploit has been publishe [truncated]
A vulnerability was detected in GL.iNet GL-MT3000 up to 4.4.5. The affected element is the function logread.get_system_log of the file /usr/lib/oui-httpd/rpc/logread of the component Logread Lua RPC plugin. The manipulation of the argument module results in command injection. The attack can be launched remotely. The exploit is now public and may be used.
A vulnerability was detected in GL.iNet MT3000, MT6000, BE9300, BE3600, MT3600BE, E5800, BE6500, MT5000, X3000, XE3000, and MT2500 up to 20260707. The affected element is the function nas-web.get_file_list of the component APPS-NAS Module. Performing a manipulation results in heap-based buffer overflow. The attack may be initiated remotely. This issue affects various GL.iNet devices, potentially allowing [truncated]
CVE-2026-18584 is a security vulnerability detected in GL.iNet E5800, E750, X2000, X3000, XE3000, and XE300 up to 20260707. The vulnerability impacts an unknown function of the file /sdk/v1 of the eSIM LPA API component, leading to improper authorization. The attack can only be initiated within the local network. Organizations should verify and apply vendor remediation to prevent improper authorization at [truncated]
A security vulnerability has been detected in GL.iNet GL-MT3000 up to 4.4.5. Affected by this vulnerability is an unknown functionality of the file /usr/bin/one_click_upgrade of the component Online Firmware Upgrade Handler. Such manipulation leads to command injection. The attack can be launched remotely. The exploit has been disclosed publicly and may be used. Upgrading to version 4.7 addresses this iss [truncated]
A weakness has been identified in GL.iNet GL-MT3000 up to 4.4.5. Affected is the function replace_country in the library /usr/lib/oui-httpd/rpc/tor of the component Tor Proxy Service Configuration Handler. This manipulation causes command injection. The attack can be initiated remotely. The exploit has been made available to the public and could be used for attacks. Upgrading to version 4.7 is able to add [truncated]
A vulnerability has been identified in multiple GL.iNet devices, including A1300, AX1800, AXT1800, MT2500, MT3000, MT6000, X3000, and XE3000 running firmware version 4.8.x. This vulnerability affects an unknown function within the glnassys component, potentially allowing remote attackers to utilize a hard-coded cryptographic key. The attack is considered difficult to execute, requiring a high level of com [truncated]
A command injection vulnerability has been discovered in GL.iNet GL-MT3000 up to 4.4.5. The vulnerability affects the SET_USER_PWD Handler in the /cgi-bin/glc file, specifically in the FUN_0042e200 function. The manipulation of the Password argument leads to command injection, allowing remote attackers to execute arbitrary commands. The vulnerability has a CVSS score of 6.9 and is classified as MEDIUM sev [truncated]
A vulnerability was discovered in GL.iNet GL-MT3000 version 4.4.5. The issue lies in the snprintf function of the /cgi-bin/glc file within the FTP Protocol Handler component. An attacker can exploit this by manipulating the media_dir argument, leading to command injection. This attack can be launched remotely. The vulnerability has a CVSS score of 6.9 and is classified as MEDIUM severity. The issue is res [truncated]
A command injection vulnerability was detected in GL.iNet GL-MT3000 version 4.4.5. This vulnerability affects the function dlopen in the library /usr/lib/oui-httpd/rpc/ of the component Path Normalization Handler. An attacker can manipulate the argument dev_name to inject commands, allowing for a remote attack. The vulnerability has a CVSS score of 6.9 and is classified as MEDIUM severity. Upgrading to ve [truncated]
A weakness has been identified in GL.iNet GL-MT3000 up to 4.4.5. The affected element is the function realpath of the file /rpc of the component Minidlna Service. This manipulation of the argument kube. set causes command injection. The attack is possible to be carried out remotely. Upgrading to version 4.7 is sufficient to fix this issue. It is recommended to upgrade the affected component. The vendor co [truncated]
A vulnerability was determined in GL.iNet MT3000 up to 4.4.5. This vulnerability affects unknown code of the file ovpnclient.sh of the component OpenVPN Client Import Workflow. This manipulation causes command injection. Remote exploitation of the attack is possible. The exploit has been publicly disclosed and may be utilized. Upgrading to version 4.9.0_beta3-1012-0513-1778656146 is able to resolve this i [truncated]
The GL-iNet Comet (GL-RM1) KVM before version 1.8.2 has a critical vulnerability that allows unauthenticated root access via the UART serial console. This attack requires physical access to the device and connection to the UART pins. The vulnerability was reported on March 10, 2026, and publicly disclosed on March 17, 2026. The CVSS score for this vulnerability is 6.8, indicating a medium severity. The vu [truncated]
The GL-iNet Comet (GL-RM1) KVM before version 1.8.2 has a vulnerability that allows an attacker-in-the-middle or a compromised update server to modify the firmware and the corresponding MD5 hash to pass verification. This issue arises from insufficient verification of uploaded firmware files. The Common Vulnerability Scoring System (CVSS) score for this vulnerability is 4.7, indicating a medium severity l [truncated]