CVE-2026-26795 is a critical (CVSS 9.8) command injection in the get_system_log function of GL-iNet GL-AR300M16 firmware v4.3.11, reached through the module parameter. The record names no fixed version. Restrict access to the router's management interface and check GL-iNet's firmware page for a patched release.
What's affected
The record names the GL-iNet GL-AR300M16 router and firmware version 4.3.11. The injectable input is the module parameter of the M.get_system_log function.
No fixed version appears in the record, and its only reference is a third party write up. Check the vendor for anything newer.
How to check if you're exposed
Read the firmware version on the router's admin page. Version 4.3.11 matches the record.
Then check reachability. The vector is network based, needs no privileges and no user interaction, so exposure depends mostly on who can reach the admin interface or its API.
What to do now
- Find every AR300M16 in your estate and note its firmware version.
- Remove internet and guest network access to the management interface.
- Watch GL-iNet's downloads and advisories for a release that names this CVE, then upgrade.
- Change admin credentials after the upgrade and review the device configuration for unexpected changes.
- The same product has CVE-2026-26792 in set_upgrade, so patch both together once a fix lands.
Why it matters
The class is CWE-77, command injection. A log viewer should only read data, but when a request value reaches a shell command unfiltered, a read feature becomes a code execution path.
The record does not mark this CVE as known exploited. Still, a network reachable, no login injection on a router is the kind of issue worth closing off by access control while you wait for a patch.
Quick check
Does this need a login?
The CVSS vector says no privileges are required. Treat the management interface as exposed if it is reachable.
Sources
- CVE-2026-26795 on Gold
- NVD record for CVE-2026-26795, published 12 March 2026
- Third party GitHub write up linked from the NVD record (under the sezangel IOT-vul repository, GL-iNet AR300M16 folder)
Last reviewed: 19 October 2026.
