CVE-2026-18615 | GL-iNet GL-MT3000 up to 4.4.5 wg-server.so Native Plugin /cgi-bin/glc wg-server.generate_publickey private_key command injection

A vulnerability, which was classified as critical, was found in GL-iNet GL-MT3000 up to 4.4.5. The affected element is the function wg-server.generate_publickey of the file /cgi-bin/glc of the component wg-server.so Native Plugin. Executing a manipulation of the argument private_key can lead to command injection.

The identification of this vulnerability is CVE-2026-18615. The attack may be launched remotely. Furthermore, there is an exploit available.

The vendor was contacted early about this disclosure and confirmed the existence of the vulnerability.