CVE-2026-18686 | GL.iNet GL-MT3000 up to 4.4.5 nas-web RPC Wrapper /cgi-bin/glc nas-web.add_user command injection

A vulnerability identified as critical has been detected in GL.iNet GL-MT3000 up to 4.4.5. The affected element is the function nas-web.add_user of the file /cgi-bin/glc of the component nas-web RPC Wrapper. Performing a manipulation results in command injection.

This vulnerability is identified as CVE-2026-18686. The attack can be initiated remotely. Additionally, an exploit exists.

The vendor was contacted early about this disclosure and confirmed the existence of the vulnerability.