Executive Summary
A critical OS command injection vulnerability (CVE-2026-18602, CVSS 9.8) has been identified in GL.iNet GL-MT3000 routers running firmware version 4.4.5 and earlier. The flaw exists in the ovpn-client.get_recommend_config function within /cgi-bin/glc, part of the router's OpenVPN client plugin (ovpn-client.so). By manipulating the Hostname argument, a remote attacker can inject arbitrary shell commands that execute on the device with elevated privileges.
GL.iNet routers are popular among home users, small businesses, and privacy-focused users deploying VPNs — this vulnerability puts all affected deployments at risk of complete device compromise.
Vulnerability Overview
| Attribute | Value |
|---|---|
| CVE ID | CVE-2026-18602 |
| CVSS Score | 9.8 (Critical) |
| Type | OS Command Injection |
| Affected Component | ovpn-client.so Native Plugin, /cgi-bin/glc |
| Vulnerable Function | ovpn-client.get_recommend_config |
| Vulnerable Parameter | Hostname argument |
| Attack Vector | Network (remotely exploitable) |
| Privileges Required | Low (varies by network access level) |
| User Interaction | None |
Affected Versions
| Device | Affected Firmware | Fixed Version |
|---|---|---|
| GL.iNet GL-MT3000 | All versions up to 4.4.5 | Check GL.iNet firmware updates |
Technical Analysis
The GL-MT3000 provides an OpenVPN client interface through a CGI binary (/cgi-bin/glc). The ovpn-client.get_recommend_config function accepts a Hostname parameter intended to specify the VPN server endpoint. Due to insufficient input sanitization, the Hostname value is passed directly into a shell command or system call without proper escaping.
An attacker who can reach the router's CGI interface can inject shell metacharacters (;, |, &&, backticks) to break out of the intended command context and execute arbitrary OS commands.
Exploit Pattern:
Vulnerable endpoint: /cgi-bin/glc (via ovpn-client.get_recommend_config)
Malicious input: Hostname = "vpn.example.com; id; cat /etc/passwd"
Result: Router executes:
ovpn_client_get_config vpn.example.com
id
cat /etc/passwd
The injected commands run with the privilege level of the web server process
(typically root on consumer routers).Why CVSS 9.8?
The near-perfect score reflects:
- No authentication required in certain attack scenarios (or low-privilege access sufficient)
- Network-accessible attack vector
- No user interaction needed
- Full system compromise possible — routers typically run commands as root
Impact Assessment
| Impact | Description |
|---|---|
| Full Device Compromise | Execute arbitrary commands as root on the router |
| Network Traffic Interception | Modify routing rules to MITM all traffic |
| VPN Credential Theft | Extract saved VPN credentials and certificates |
| Persistent Backdoor | Install persistent access via cron or init scripts |
| Network Pivoting | Use compromised router to attack LAN-side devices |
| DNS Hijacking | Redirect DNS to attacker-controlled servers |
| Botnet Recruitment | Enroll device into IoT botnet (Mirai-style) |
Remediation
Step 1: Check Your Firmware Version
Access the GL.iNet admin panel (typically at http://192.168.8.1) and navigate to System > Upgrade to check the current firmware version.
Step 2: Update Firmware
# Check GL.iNet's official firmware download page for GL-MT3000 updates
# https://dl.gl-inet.com/router/mt3000/
# Via the admin panel:
# System > Upgrade > Online Upgrade or Manual UpgradeMonitor GL.iNet's release notes for a patched firmware addressing CVE-2026-18602.
Step 3: Restrict Administrative Interface Access
While awaiting a patch, limit access to the router's admin interface:
# Via GL.iNet admin panel:
# Security > Administration > Restrict access to LAN-only
# If you have SSH access, add iptables rules:
iptables -I INPUT -p tcp --dport 80 -s 192.168.8.0/24 -j ACCEPT
iptables -I INPUT -p tcp --dport 80 ! -s 192.168.8.0/24 -j DROPStep 4: Disable OpenVPN Client Feature if Unused
If you are not using the OpenVPN client functionality, disable it:
- Navigate to VPN > OpenVPN Client in the admin panel
- Ensure no VPN profiles are active
- Consider disabling the VPN client plugin if your firmware version allows
Step 5: Rotate VPN Credentials
If the router has been potentially compromised:
- Revoke all VPN certificates associated with the device
- Generate new certificates and update the router post-patch
- Change the router admin password immediately
- Factory reset if compromise is suspected
Detection Indicators
| Indicator | Description |
|---|---|
| Unexpected outbound connections | Data exfiltration or C2 communication |
| Unknown processes running on router | Backdoor or malware installation |
Modified /etc/hosts or DNS settings | DNS hijacking post-exploitation |
| Admin password changed unexpectedly | Attacker locking out legitimate admin |
| Unfamiliar SSH keys in authorized_keys | Persistent access established |
Check router logs via admin panel or SSH:
# View recent system logs (if SSH enabled)
ssh root@192.168.8.1
logread | tail -100Broader GL.iNet Security Context
GL.iNet devices have faced multiple CVEs over recent years related to command injection in CGI handlers. Organizations relying on GL.iNet routers for VPN gateways or travel routers should:
- Maintain a firmware update cadence aligned with GL.iNet's release schedule
- Enable automatic firmware updates where supported
- Segment the router's admin interface from untrusted networks
- Subscribe to GL.iNet security advisories