CVE-2026-18684 | GL.iNet GL-MT3000 up to 4.4.5 modem.so /cgi-bin/glc remove_profile command injection

A vulnerability was found in GL.iNet GL-MT3000 up to 4.4.5. It has been rated as critical. This issue affects the function remove_profile of the file /cgi-bin/glc of the component modem.so. This manipulation causes command injection.

The identification of this vulnerability is CVE-2026-18684. It is possible to initiate the attack remotely. Furthermore, there is an exploit available.

The vendor was contacted early about this disclosure and confirmed the existence of the vulnerability.