CVE-2026-18616

Name of the Vulnerable Software and Affected Versions GL-iNet GL-MT3000 versions prior to 4.4.6

Description Command injection is possible via remote exploitation in the wg-server.so Native Plugin. The issue exists within the server.set peer() function located in the /cgi-bin/glc file, where improper handling of the public key variable allows for the execution of arbitrary commands.

Recommendations Update GL-iNet GL-MT3000 to version 4.4.6 or later. As a temporary mitigation, restrict access to the /cgi-bin/glc endpoint to prevent unauthorized manipulation of the public key variable.