CVE-2026-18684: GL.iNet GL-MT3000 modem.so glc remove_profile command injection
A weakness has been identified in GL.iNet GL-MT3000 up to 4.4.5. This issue affects the function removeprofile of the file /cgi-bin/glc of the component modem.so. This manipulation causes command injection. It is possible to initiate the attack remotely. The exploit has been made available to the public and could be used for attacks. The vendor was contacted early about this disclosure and confirmed the existence of the vulnerability.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Implement a control to prevent use of the /cgi-bin/glc function remove_profile in modem.so (where command injection occurs), since the vulnerability is in remove_profile and can be triggered remotely.
GL.iNet GL-MT3000 (modem.so /cgi-bin/glc) remove_profile command injection = disable or block remove_profile usage if a configuration or access control exists to prevent execution of this function - Compensating control
Restrict network access to the GL.iNet GL-MT3000 web/CGI interface (/cgi-bin/glc) so the remove_profile function cannot be invoked remotely.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-18684?
CVE-2026-18684 has a critical severity rating of 9.8.
What vulnerability does CVE-2026-18684 describe?
CVE-2026-18684 describes a command injection vulnerability in the remove_profile function of the GL.iNet GL-MT3000 modem.
How can CVE-2026-18684 be exploited?
CVE-2026-18684 can be exploited remotely due to the command injection flaw in the modem's software.
Which versions of GL.iNet GL-MT3000 are affected by CVE-2026-18684?
GL.iNet GL-MT3000 versions up to 4.4.5 are affected by CVE-2026-18684.
How do I fix CVE-2026-18684?
To fix CVE-2026-18684, upgrade the GL.iNet GL-MT3000 modem software to a version beyond 4.4.5 that addresses this vulnerability.