CVE-2026-18685

Name of the Vulnerable Software and Affected Versions GL.iNet GL-MT3000 versions prior to 4.4.6

Description An issue exists in the modem.so component due to a lack of input sanitization. This allows a remote attacker to perform command injection via the set upgrade() function within the '/cgi-bin/glc' endpoint. Command injection is a flaw that allows an attacker to execute arbitrary operating system commands on the target machine.

Recommendations Update to a version newer than 4.4.5. As a temporary workaround, restrict access to the '/cgi-bin/glc' endpoint to minimize the risk of exploitation.