CVE-2026-26793

CRITICAL

GL-iNet GL-AR300M16 v4.3.11 - Command Injection

Title source: llm

Description

GL-iNet GL-AR300M16 v4.3.11 was discovered to contain a command injection vulnerability via the set_config function. This vulnerability allows attackers to execute arbitrary commands via a crafted input.

References (1)

Scores

CVSS v3 9.8
EPSS 0.0094
EPSS Percentile 76.2%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Details

CWE
CWE-77
Status published
Products (1)
gl-inet/ar300m16_firmware 4.3.11
Published Mar 12, 2026
Tracked Since Mar 13, 2026