CVE-2026-26791 is a critical command injection flaw (CVSS 9.8) in the GL.iNet GL-AR300M16 router running firmware 4.3.11. The port parameter of the enable_echo_server function can be used to run arbitrary commands. The record names no fix, so restrict access to the admin interface and check for newer firmware.
What's affected
The NVD record names the GL.iNet GL-AR300M16 with firmware v4.3.11. It does not say whether earlier or later firmware versions are affected, and it names no patched release.
The flaw is in the enable_echo_server function, through its port parameter, according to the public report the record cites. The record rates it as needing no login.
How to check if you're exposed
Check the firmware version in the router's admin interface, usually on the system or upgrade page. If it is 4.3.11, treat the device as affected.
Then check where the admin interface answers. It should not be reachable from the internet, and ideally only from a trusted management address.
Look at the vendor's firmware download page for a build newer than 4.3.11 and read its release notes. The record does not tell us if one fixes this.
What to do now
- Find every GL-AR300M16 you run and note its firmware version.
- Turn off remote administration from the WAN side, and limit local admin access to trusted devices.
- Check GL.iNet's firmware page and release notes for a newer version, and update if one addresses this CVE.
- Change the admin password to a strong, unique one, and review the router's settings for changes you did not make.
- If the router sits in a lab or branch office, consider placing it on a separate network from systems that hold sensitive data.
Why it matters
The weakness is CWE-77, command injection. The firmware takes a value from a request, here a port number given as a string, and passes it into a shell command without checking that it really is a number. Characters in the value can then change which command runs.
The vector shows network access with no login and no user action, and high impact on confidentiality, integrity and availability. The record is not on the CISA Known Exploited Vulnerabilities list. A router is a good place for an attacker to sit, because it sees all the traffic of the network behind it.
The fix for this class of bug is simple: validate input as the type it should be, and avoid building shell commands from request data at all.
Quick check
Is there a firmware that fixes CVE-2026-26791?
The record names none. Check GL.iNet's release notes.
Sources
Last reviewed: 19 October 2026.
