CVE-2026-18686

Name of the Vulnerable Software and Affected Versions GL.iNet GL-MT3000 versions prior to 4.4.6

Description A command injection issue exists in the nas-web RPC Wrapper component within the /cgi-bin/glc file. The flaw is located in the nas-web.add user() function, where the software fails to properly neutralize special elements in the output data. This allows a remote attacker to execute arbitrary commands on the device.

Recommendations Update GL.iNet GL-MT3000 to version 4.4.6 or later. As a temporary mitigation, restrict access to the /cgi-bin/glc endpoint or disable the nas-web.add user() function.