CRITICALVulnerability
Verified
Global

NVD CRITICAL: CVE-2026-18614 — A vulnerability was found in GL-iNet GL-MT3000 up to 4.4.5. Impacted is the func...

·Source: NIST NVD

Updated:

Executive Summary

A vulnerability was found in GL-iNet GL-MT3000 up to 4.4.5. Impacted is the function s2s.enable_echo_server of the file /cgi-bin/glc of the component s2s.so Native Plugin. Performing a manipulation of the argument port results in command injection. The attack may be initiated remotely. The exploit has been made public and could be used. The vendor was contacted early about this disclosure and conf

Analysis

A vulnerability was found in GL-iNet GL-MT3000 up to 4.4.5. Impacted is the function s2s.enable_echo_server of the file /cgi-bin/glc of the component s2s.so Native Plugin. Performing a manipulation of the argument port results in command injection. The attack may be initiated remotely. The exploit has been made public and could be used. The vendor was contacted early about this disclosure and confirmed the existence of the vulnerability. CVSS Score: 9.8. Published: 2026-08-03T19:16:45.200.

Indicators of Compromise (1)

CVE (1)
CVE-2026-18614
NVDMITRE CVE
Source Attribution

Originally published by NIST NVD on Aug 3, 2026. Verified by: NIST.

Related Threats

CRITICALVulnerability

NVD CRITICAL: CVE-2026-18616 — A vulnerability was identified in GL-iNet GL-MT3000 up to 4.4.5. The impacted el...

A vulnerability was identified in GL-iNet GL-MT3000 up to 4.4.5. The impacted element is the function server.set_peer of the file /cgi-bin/glc of the component wg-server.so Native Plugin. The manipulation of the argument public_key leads to command injection. Remote exploitation of the attack is possible. The exploit is publicly available and might be used. The vendor was contacted early about thi

CVE-2026-18616
NIST NVD
CRITICALVulnerability

NVD CRITICAL: CVE-2026-18615 — A vulnerability was determined in GL-iNet GL-MT3000 up to 4.4.5. The affected el...

A vulnerability was determined in GL-iNet GL-MT3000 up to 4.4.5. The affected element is the function wg-server.generate_publickey of the file /cgi-bin/glc of the component wg-server.so Native Plugin. Executing a manipulation of the argument private_key can lead to command injection. The attack may be launched remotely. The exploit has been publicly disclosed and may be utilized. The vendor was co

CVE-2026-18615
NIST NVD
MEDIUMVulnerability

Defcon Aerospace Village Seeks Broader Appeal This Year

<img src="https://ismg-cdn.nyc3.cdn.digitaloceanspaces.com/articles/defcon-aerospace-village-seeks-broader-appeal-this-year-image_small-2-a-32400.jpg" align=right hspace=4><b>That’s No Moon, It’s an Insecure PLC</b><br>The Aerospace Village at annual hacking conference Defcon, famed as the home of the Hack-A-Sat contest which culminated in 2023 with the live hacking of a real satellite in orbit, w

Bank Info Security