CVE-2026-18612: GL-iNet GL-MT3000 plugins.so Native Plugin glc plugins.install_package command injection
A flaw has been found in GL-iNet GL-MT3000 up to 4.4.5. This vulnerability affects the function plugins.removepackage/plugins.installpackage of the file /cgi-bin/glc of the component plugins.so Native Plugin. This manipulation causes command injection. The attack can be initiated remotely. The exploit has been published and may be used. The vendor was contacted early about this disclosure and confirmed the existence of the vulnerability.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-18612?
CVE-2026-18612 has a critical severity rating of 9.8.
How do I fix CVE-2026-18612?
To mitigate CVE-2026-18612, update GL-iNet GL-MT3000 to version 4.4.6 or later as per the vendor's recommendations.
What type of vulnerability is CVE-2026-18612?
CVE-2026-18612 is classified as a command injection vulnerability.
Can CVE-2026-18612 be exploited remotely?
Yes, CVE-2026-18612 can be exploited remotely.
Which software versions are affected by CVE-2026-18612?
CVE-2026-18612 affects GL-iNet GL-MT3000 versions up to 4.4.5.