CVE-2026-18614: Critical Command Injection in GL.iNet GL-MT3000 s2s

CVE-2026-18614 is a critical command injection flaw (CVSS 9.8) in GL.iNet GL-MT3000 firmware up to 4.4.5. The s2s.enable_echo_server function mishandles the port argument. The exploit is public and the vendor confirmed the issue. Install the newest firmware and keep the admin interface off the internet.

What's affected

GL-MT3000 firmware up to and including 4.4.5 is affected. The record names the s2s.so native plugin and the /cgi-bin/glc endpoint. It says the vendor confirmed the flaw. It lists no fixed version, so check GL.iNet's firmware page.

How to check if you're exposed

Read the firmware version in the router admin panel. At or below 4.4.5 matches. Compare with the latest release on GL.iNet's download page for the MT3000.

Safeguard's free dependency scan at gold.safeguard.sh/scan reads manifests and lock files, so it will not see device firmware or an installed appliance. Use it for the application dependencies around this product, and use the vendor's own version check for the product itself.

What to do now

1. List every GL-MT3000 you manage and its firmware version.
2. Install the latest firmware GL.iNet offers.
3. Disable remote administration and do not publish the admin panel to the internet.
4. Review the device for unexpected settings or services after patching if it was exposed.

Why it matters

This is another case of CWE-77, command injection, with parent CWE-74. A value, here a port number, reaches a command without being checked. Devices like this run services as a privileged user, so one flaw can mean full control.

It shares a firmware version and endpoint with CVE-2026-18602, so one firmware update should cover both if GL.iNet's release notes say so. Check them. The record says the exploit is public; the CVE is not in CISA's KEV list.

Quick check

Sources

• Public write-up listed in the CVE record

Last reviewed: 19 October 2026.