CVE-2026-18685 | GL.iNet GL-MT3000 up to 4.4.5 modem.so /cgi-bin/glc set_upgrade command injection

A vulnerability categorized as critical has been discovered in GL.iNet GL-MT3000 up to 4.4.5. Impacted is the function set_upgrade of the file /cgi-bin/glc of the component modem.so. Such manipulation leads to command injection.

This vulnerability is referenced as CVE-2026-18685. It is possible to launch the attack remotely. Furthermore, an exploit is available.

The vendor was contacted early about this disclosure and confirmed the existence of the vulnerability.