CVE-2026-18613: GL-iNet GL-MT3000 plugins.so Native Plugin glc plugins.set_config injection

Severity: critical (CVSS 9.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.0% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-08-03 · updated 2026-10-23
Weakness: CWE-74

Description

A vulnerability has been found in GL-iNet GL-MT3000 up to 4.4.5. This issue affects the function plugins.set_config of the file /cgi-bin/glc of the component plugins.so Native Plugin. Such manipulation leads to injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure and confirmed the existence of the vulnerability.

Affected products

GL-iNet GL-MT3000: 4.4.0, 4.4.1, 4.4.2, 4.4.3, 4.4.4, 4.4.5

References

https://github.com/StrTzz123/iot_vul/blob/main/GL-iNet/MT3000/4.4.5/plugins_set_config_glc_write/CVE.md
https://vuldb.com/cve/CVE-2026-18613
https://vuldb.com/submit/851557
https://vuldb.com/vuln/385533
https://vuldb.com/vuln/385533/cti

Get alerted when CVE-2026-18613 or the next vulnerability affects your stack