CVE-2026-18615: GL-iNet GL-MT3000 wg-server.so Native Plugin glc wg-server.generate_publickey command injection
A vulnerability was determined in GL-iNet GL-MT3000 up to 4.4.5. The affected element is the function wg-server.generatepublickey of the file /cgi-bin/glc of the component wg-server.so Native Plugin. Executing a manipulation of the argument privatekey can lead to command injection. The attack may be launched remotely. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure and confirmed the existence of the vulnerability.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-18615?
CVE-2026-18615 has a critical severity rating of 9.8.
How do I fix CVE-2026-18615?
To mitigate CVE-2026-18615, update the GL-iNet GL-MT3000 firmware to version 4.4.6 or later.
What type of vulnerability is CVE-2026-18615?
CVE-2026-18615 is a command injection vulnerability.
Which versions of the software are affected by CVE-2026-18615?
CVE-2026-18615 affects GL-iNet GL-MT3000 versions up to 4.4.5.
What can an attacker achieve with CVE-2026-18615?
An attacker can exploit CVE-2026-18615 to execute arbitrary commands on the affected system through manipulation of the private_key argument.