GL-iNet: PoC pubblici per lo sfruttamento delle CVE-2026-18601, CVE-2026-18602, CVE-2026-18612, CVE-2026-18616 - ACN
Italian CSIRT (ACN) advisory AL04/260804/CSIRT-ITA confirms public Proof of Concept availability for four unauthenticated command injection vulnerabilities in GL.iNet GL-MT3000 (Beryl AX) routers running firmware up to 4.4.5. All four CVEs carry CVSS 9.8 and allow remote code execution as root via the /cgi-bin/glc RPC endpoint without authentication. CVE-2026-18601: ovpn-client.check_config, unsanitized filename parameter injected into tar command via single-quote escape. CVE-2026-18602: ovpn-client.get_recommend_config, unsanitized hostname parameter passed to sprintf/system(). CVE-2026-18612: plugins.install_package/remove_package, unsanitized package name with only prefix-based blacklist bypass. CVE-2026-18616: wg-server.set_peer, unsanitized public_key parameter passed to sprintf/system(). The ACN advisory recommends applying vendor patches; corroborating sources note no fixed firmware version is confirmed. Unauthenticated access is confirmed by IONIX technical analysis; the ACN advisory describes remote attack without explicitly stating the authentication requirement.
Research notes
- Root causeAll four vulnerabilities are command injection flaws in the /cgi-bin/glc CGI endpoint caused by missing or insufficient sanitization of user-supplied parameters before they are used in shell command execution contexts via system() or sprintf()+system() patterns.GL-iNet: PoC pubblici per lo sfruttamento delle CVE-2026-18601, CVE-2026-18602, CVE-2026-18612, CVE-2026-18616 - ACN CVE-2026-18601 – Unauthenticated Remote Code Execution (Command Injection) – GL.iNet GL-MT3000 CVE-2026-18602 – Unauthenticated Command Injection (RCE) – GL.iNet GL-MT3000 CVE-2026-18612 – Unauthenticated Command Injection (RCE) – GL.iNet GL-MT3000 CVE-2026-18616 – Unauthenticated Command Injection (RCE) – GL.iNet GL-MT3000
- Technical detailCVE-2026-18601: ovpn-client.check_config, unsanitized filename parameter injected via single-quote escape in tar command. CVE-2026-18602: ovpn-client.get_recommend_config, unsanitized hostname parameter via command substitution in sprintf/system(). CVE-2026-18612: plugins.install_package/remove_package, unsanitized package name with prefix-only blacklist bypass. CVE-2026-18616: wg-server.set_peer, unsanitized public_key parameter in sprintf/system() template.GL-iNet: PoC pubblici per lo sfruttamento delle CVE-2026-18601, CVE-2026-18602, CVE-2026-18612, CVE-2026-18616 - ACN CVE-2026-18601 – Unauthenticated Remote Code Execution (Command Injection) – GL.iNet GL-MT3000 CVE-2026-18602 – Unauthenticated Command Injection (RCE) – GL.iNet GL-MT3000 CVE-2026-18612 – Unauthenticated Command Injection (RCE) – GL.iNet GL-MT3000 CVE-2026-18616 – Unauthenticated Command Injection (RCE) – GL.iNet GL-MT3000
- PoC researchPublic Proof of Concept exploits are available for all four CVEs, as confirmed by the Italian CSIRT advisory and corroborated by IONIX threat intelligence pages which reference a public GitHub PoC repository.
- MitigationThe ACN advisory recommends applying the most recent security patches from the vendor. Affected versions are GL-MT3000 firmware 4.4.x up to 4.4.5. Corroborating sources note that no specific fixed firmware version is confirmed in public CVE records.