CVE-2026-18602 is a critical command injection flaw (CVSS 9.8) in GL.iNet GL-MT3000 router firmware up to 4.4.5. The ovpn-client.get_recommend_config function mishandles the Hostname argument. A public exploit exists and the vendor confirmed the issue. Install any newer firmware GL.iNet has released.
What's affected
GL.iNet GL-MT3000 firmware up to and including 4.4.5 is affected. The record points to the ovpn-client.so native plugin and the /cgi-bin/glc endpoint. It says the vendor confirmed the vulnerability but does not list a fixed version, so check GL.iNet's firmware download page.
How to check if you're exposed
Open the router's admin panel and read the firmware version on the system or upgrade page. Version 4.4.5 or lower matches. Then compare with the latest firmware GL.iNet lists for the MT3000.
Safeguard's free dependency scan at gold.safeguard.sh/scan reads manifests and lock files, so it will not see device firmware or an installed appliance. Use it for the application dependencies around this product, and use the vendor's own version check for the product itself.
What to do now
- Check the firmware version on every GL-MT3000.
- Install the newest firmware from GL.iNet.
- Make sure the admin interface is not reachable from the internet, and turn off remote management you do not use.
- Change the admin password if you cannot update right away, and keep the router off untrusted segments.
Why it matters
Command injection, CWE-77 and its parent CWE-74, occurs when a value supplied by a user is placed into a command that the device then runs. On a router, that code runs with high privilege. The CVSS vector shows a network attack with no privileges and no interaction, hence the 9.8.
The record says an exploit has been disclosed publicly. It does not say attacks were observed, and the CVE is not in CISA's KEV list. Routers sit at the edge of a network, so treat a public exploit as a reason to move fast.
Quick check
Is there a fixed firmware?
The record does not name one. Check GL.iNet's download page.
Is it the same as CVE-2026-18614?
No. It is a separate command injection in a different plugin of the same firmware.
Sources
Last reviewed: 19 October 2026.
