🕵️ RESEARCH & DEEP DIVES
- Critical Command Injection Flaw Found in GL.iNet GL-MT3000 up to Firmware 4.4.5
CVE-2026-18686
A remote command injection vulnerability affects GL.iNet GL-MT3000 devices up to version 4.4.5.- Applies to GL.iNet GL-MT3000 devices running firmware versions 4.4.0 through 4.4.5
- Vulnerability exists in nas-web.add_user function of /cgi-bin/glc component
- Allows unauthenticated remote attackers to perform command injection
- Exploit code is publicly available and confirmed by the vendor
- Severity rated critical with CVSS scores up to 9.8
📎 Coverage: cve.threatint.com · 📄 Original: cve.threatint.com · 👁 via CVE ThreatInt
🔓 CVEs & KEV
- CVE-2026-11835 — CVSS — — Caliptra Update-Reset Secure-Boot Bypass via Attacker-Chosen AXI Staging Addr...
- CVE-2026-11836 — CVSS — — Production Debug-Unlock Token Verification Missing Device BindingInsufficient...