CVE-2026-18686 | GL.iNet | Valters IT Hub
Technical analysis of an unauthenticated command injection vulnerability in the GL.iNet GL-MT3000 travel router (firmware up to 4.4.5). The flaw resides in the nas-web.add_user function of the /cgi-bin/glc CGI endpoint within the nas-web RPC wrapper. The affected code path fails to sanitize user-supplied input in the username parameter, which is concatenated directly into a system command invocation without shell escaping. The function is reachable without authentication because the glc wrapper fails to enforce session validation for this RPC method. Commands execute as root. A corroborating advisory (IONIX) describes the injection as a two-stage second-order path through nas-web.add_share. Public exploit code is available. The writeup includes Sigma, YARA, Suricata, Elastic, Splunk, and Wazuh detection rules plus mitigation guidance. The source states the vulnerability is unpatched as of 2026-08-04; GL.iNet's public firmware page lists version 4.8.1 for this model, which may postdate the writeup.
Research notes
- Root causeThe nas-web.add_user function in /cgi-bin/glc fails to sanitize the username parameter before concatenating it into a system command invocation, enabling shell metacharacter injection.
- Technical detailThe glc wrapper fails to enforce session validation for the nas-web.add_user RPC method, making the command injection reachable without authentication.
- Technical detailCommands execute as root because the CGI process runs with elevated privileges and the injected command inherits the process's effective UID.
- Technical detailA corroborating advisory describes the injection as a two-stage second-order path: nas-web.add_user stores an unsanitized password in a database, and a subsequent nas-web.add_share call retrieves it and passes it to smbpasswd without shell escaping.
- PoC researchPublic exploit code demonstrating the injection technique has been published in a GitHub repository. The exploit mechanism is straightforward.
- DetectionSigma, YARA, Suricata, Elastic, Splunk, and Wazuh detection rules are provided for identifying exploitation attempts against the nas-web.add_user endpoint.