CVE-2026-18684

Name of the Vulnerable Software and Affected Versions GL.iNet GL-MT3000 versions prior to 4.4.6

Description An issue exists in the modem.so component due to insufficient input validation. A remote attacker can exploit this to perform command injection via the remove profile() function at the '/cgi-bin/glc' endpoint. Command injection is a flaw that allows an attacker to execute arbitrary operating system commands on the affected device.

Recommendations Update to a version newer than 4.4.5. As a temporary workaround, restrict access to the '/cgi-bin/glc' endpoint to minimize the risk of exploitation.